aml-check[.]rest

The domain aml-check.rest is a phishing site engaged in brand impersonation targeting victims through an 'AML Scam' fraud scheme. It mimics legitimate anti-money laundering (AML) verification processes to deceive users into disclosing sensitive information or transferring funds under false pretenses. No crypto drainer kit was identified, but the site posed an elevated risk due to its deceptive branding. As of the latest verification, aml-check.rest has been taken offline.

Technical indicators confirm the domain's malicious intent. Two of 95 VirusTotal security vendors flagged aml-check.rest, including Fortinet, while Google Safe Browsing did not detect it. The domain appears on one security blocklist (PhishDestroy) and was registered through WEBCC on March 24, 2026. It resolved to the IP address 172.67.214.184, hosted by Cloudflare in Canada, with no SSL certificate issued. The observed page title was 'Aml-check', and technologies detected include Cloudflare Browser Insights and HTTP/3. Nameservers associated with the domain are asa.ns.cloudflare.com, elias.ns.cloudflare.com, and faye.ns.cloudflare.com.

Victims of aml-check.rest should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on all financial and sensitive accounts, and monitor for unauthorized transactions or identity fraud. If cryptocurrency was involved, revoke any token approvals granted to suspicious contracts and transfer remaining funds to a new wallet. Report the phishing domain to relevant authorities, such as the Anti-Phishing Working Group (APWG) or local cybercrime units, and notify the impersonated brand (AML Scam) to aid in mitigation efforts.