aml-dashboard[.]com

Analysis of aml-dashboard.com indicates a recent brand impersonation campaign targeting Facebook users with a crypto‑related scam. The site was registered on 23 October 2025 through the registrar Name SRS AB and is hosted on Cloudflare infrastructure (AS13335, United States). DNS resolution points to 188.114.96.3 and the domain uses the Cloudflare nameservers pablo.ns.cloudflare.com and vita.ns.cloudflare.com. No TLS certificate was observed, meaning the site did not serve HTTPS content.

The page title returned by the server was "AML scan," which does not directly reference the advertised brand but aligns with the reported crypto‑scam theme. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal scans recorded detections from two of ninety‑five security vendors, reinforcing the malicious classification. Independent scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme risk.

The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is no longer serving content. However, the underlying infrastructure—Cloudflare IP space and the registrar—remains viable for future abuse. Defenders should continue to monitor the IP address 188.114.96.3 and associated Cloudflare ranges for re‑use, update web filtering rules to block the domain and any subdomains, and enforce strict outbound controls against unauthorized crypto‑related transactions. Incident response teams should also flag any inbound traffic bearing the AML‑scan page title as suspicious, and threat‑intel sharing platforms should be updated with the observed indicators to aid broader community protection.