chainguard-aml[.]com

Analysis of chainguard-aml.com shows a short‑lived infrastructure that was actively used for a crypto‑related phishing campaign before being taken offline. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 172.67.165.30, which belongs to ASN 13335 located in the United States. DNS is served by naya.ns.cloudflare.com and nolan.ns.cloudflare.com, confirming Cloudflare as the authoritative provider. The site presented the page title "ChainGuard - Crypto AML & Wallet Risk Screening," indicating an attempt to impersonate a compliance or wallet‑screening service, and the SSL certificate was issued by Google Trust Services under the WE1 trust profile, suggesting a valid HTTPS connection.

Technical fingerprints include Cloudflare’s edge network and HTTP/3 support, both typical of legitimate services but also commonly abused by threat actors to hide origin. Reputation checks reveal the domain appears on seven security blocklists and is blocked by PhishDestroy, MetaMask, ScamSniffer, Polkadot, and SEAL, reflecting consensus among multiple safe‑browsing and anti‑phishing vendors. VirusTotal scans recorded seven positive detections out of ninety‑three scanners, reinforcing the malicious classification. The current status is offline, limiting immediate observation, and no additional payload or page content has been disclosed beyond the title.

Uncertainty remains around the full scope of the phishing kit, the number of victims, and whether any cryptocurrency addresses were harvested. Defenders should continue to block the domain at perimeter filters, monitor for any residual traffic to the associated IP range, and update endpoint and browser security policies to include the listed blocklists. Incident responders should also consider threat‑intel sharing of the domain’s identifiers to improve community awareness and prevent re‑use of the same infrastructure in future campaigns.