aml-monitoring[.]site

aml-monitoring.site was observed hosting a page titled “AML Crypto Check” and explicitly lists Binance as the targeted brand. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and created on 23 October 2025. DNS resolution points to the IPv6 address 2606:4700:3033::ac43:9e98, which belongs to Cloudflare, Inc. (AS13335) and resolves to a location in the United States. The domain uses Cloudflare’s default nameservers, malcolm.ns.cloudflare.com and stella.ns.cloudflare.com, and does not present an SSL/TLS certificate, meaning connections are unencrypted. Reputation services rate the site very poorly: Gridinsoft assigns a trust score of 0 out of 100, while Scamadviser reports 24 out of 100.

VirusTotal analysis shows that 3 of 95 scanned security vendors flagged the domain as malicious. The domain appears on a single security blocklist and has been blocked by PhishDestroy. No additional public blocklists or Safe Browsing entries are currently recorded. The site’s current status is offline, but historical evidence suggests it was used for a cryptocurrency‑related scam impersonating Binance.

Defenders should continue to block the domain at perimeter devices, monitor the associated IP range for any re‑use, and add the domain to internal watchlists. Further investigation of any HTTP traffic to the IPv6 address may reveal residual malicious payloads or command‑and‑control activity. Since the site lacks TLS, any future reuse would expose victims to clear‑text credential harvesting. The combination of low trust scores, vendor detections, and targeted brand impersonation justifies an elevated risk rating and proactive mitigation.