aml-auditor[.]com

aml-auditor.com was registered on February 21, 2026 through Dynadot LLC and resolves to the IPv4 address 172.86.94.61, which is announced by AS30823 (aurologic GmbH) in Germany. The site served HTTP 200 responses and did not present an SSL/TLS certificate, indicating a lack of transport encryption. The page title returned by the web server reads "AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check", suggesting an investment‑related lure that aligns with the classified "Investment Scam" type. The domain is listed as impersonating the brand "across", and security blocklists from PhishDestroy, MetaMask, ScamSniffer, and SEAL have flagged it.

Additional reputation systems show a Gridinsoft trust score of 0/100 and a Scamadviser score of 35/100, reinforcing the malicious assessment. VirusTotal analysis recorded 15 positive detections out of 93 scanners, confirming that multiple anti‑malware engines recognize the domain as malicious. AlienVault OTX contains a single pulse referencing this indicator, and the domain appears on four independent blocklists. The authoritative name servers are ns1.dyna-ns.net and ns2.dyna-ns.net, both associated with Dynadot's default DNS service.

As of the report date (July 23, 2026) the site is reported offline, but historical evidence suggests it was actively serving malicious content prior to takedown. Uncertainty remains regarding the exact payload delivered to victims, as the page content beyond the title has not been captured. Defenders should continue to block the domain and its IP address at perimeter and endpoint layers, monitor for any residual traffic to the listed name servers, and update detection signatures to reflect the observed page title and host header. Organizations using "across" branding should educate users about the lack of HTTPS and the fraudulent AML compliance narrative, and consider adding the domain to internal blocklists even after its removal from the public internet.