aml-viewer[.]net

The domain aml-viewer.net is a phishing site engaged in brand impersonation targeting users of the cryptocurrency platform 'across'. It presents itself as 'AMLBot - Advanced Wallet Analysis', a fake service designed to deceive victims into connecting wallets, likely to facilitate unauthorized transactions or credential theft. As of the latest verification, aml-viewer.net has been taken offline, though it previously posed an elevated risk due to its fraudulent activity.

Technical indicators confirm the malicious nature of aml-viewer.net. The domain was flagged by 1 of 95 VirusTotal security vendors, including G-Data, and appears on 2 security blocklists (PhishDestroy and ScamSniffer). Registered on July 30, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, it resolved to the IP address 172.67.136.178, hosted on Cloudflare's infrastructure (AS13335) in the US. No SSL certificate was issued, and the nameservers were dexter.ns.cloudflare.com and melina.ns.cloudflare.com. Gridinsoft assigned it a trust score of 0/100, further indicating its fraudulent intent.

Users who interacted with aml-viewer.net should immediately revoke any token approvals granted to the site and transfer funds to a new wallet to prevent potential theft. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Report the domain to platforms like ScamSniffer, PhishDestroy, or Google Safe Browsing to aid in blocking future access. Victims may also file complaints with their local cybercrime units or organizations such as the Internet Crime Complaint Center (IC3).