info-aml[.]app

This domain, info-aml.app, is flagged as a high-risk brand impersonation threat targeting cryptocurrency users under the guise of an AML compliance solution. Analysis indicates the domain mimics legitimate anti-money laundering tools, specifically impersonating AMLBot, a known crypto compliance service. The page title, 'AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check,' suggests an intent to deceive users into believing the site provides legitimate financial security services, likely to harvest credentials or facilitate fraudulent transactions. Infrastructure analysis reveals the domain was registered on April 14, 2026, through Dynadot LLC, an uncommon registration date that may indicate an attempt to evade detection. It resolves to the IP address 107.189.16.56, and VirusTotal reports 16 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms, including MetaMask and PhishDestroy. No Google Safe Browsing (GSB) status is currently available, but the combination of vendor detections and blocklist appearances underscores its malicious nature. As of the latest assessment, info-aml.app has been taken offline, reducing immediate exposure risks. However, the infrastructure remains a latent threat, as the domain could be reactivated or repurposed for similar campaigns. Users who interacted with the domain prior to its takedown should assume potential credential compromise and monitor associated accounts for unauthorized activity. Organizations are advised to block the domain and its resolving IP at the network level, and to educate users on recognizing brand impersonation tactics in crypto-related services.