aml-crypto[.]app

On July 25, 2026 analysts observed that the domain aml-crypto.app is currently offline but remains listed on five security blocklists. The domain was registered on February 21, 2026 through Web Commerce Communications Limited and resolves to the IPv6 address 2606:4700:3035::6815:2069, which is owned by Cloudflare, Inc. (AS13335) and located in the United States. Passive DNS indicates that the authoritative nameservers are lloyd.ns.cloudflare.com and stella.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. HTTP traffic was observed to negotiate HTTP/3, and the TLS certificate presented is issued by Google Trust Services under the WE1 root, suggesting a legitimate certificate chain.

The page title returned by the server is "aml-crypto.app | 522: Connection timed out", indicating that the service is not responding at the time of probing. Threat intelligence classifies the site as a crypto‑related scam, and five independent blocklist operators—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have added the domain to their deny lists. VirusTotal scans show that two of ninety‑three AV engines flagged the domain, providing limited but corroborating evidence of malicious intent. No additional public reports (e.g., OTX, Safe Browsing) were found in the current data set.

The available evidence confirms that the infrastructure is deliberately concealed behind Cloudflare, a common tactic for fast‑flux or disposable phishing sites. However, the exact payload, landing page content, or victim interaction flow has not been captured, leaving the specific attack vector uncertain. Defenders should continue to block the domain at perimeter devices, update local blocklists with the five known sources, and monitor for any resurgence of activity on the associated IPv6 address or its Cloudflare edge nodes. Incident response teams are advised to correlate any internal logs that reference aml-crypto.