Is aml-guard.net a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at aml-guard.net presents itself, through its page title and single-page homepage, as a "Web3 AML Checker", an anti-money-laundering screening utility aimed at cryptocurrency and blockchain users. It is a lightweight, text-based landing page rather than a multi-page corporate site. Its apparent purpose is to offer compliance-style address or transaction screening, a service category where visitors are typically prompted to submit wallet addresses or sensitive financial details.

Scam/Impersonation Risk

Material contradictory signals are present. The domain is blacklisted by external threat-intelligence sources, and several leading security vendors independently flag it as malicious. That convergence is the decisive factor in this assessment and outweighs everything favorable on the site. The compliance-flavored branding ("AML", "Guard") is also a recognized lure pattern. A site that appears to offer protection or screening in the crypto space can gain credibility it has not earned. No brand impersonation or conflicting legal-entity names were identified. The homepage raised no wallet-connection, clipboard-manipulation, hidden-form, or cloaking behavior in sandboxed testing, and it made no external network calls. Those clean runtime results do not offset the third-party malicious classification. The browsing sessions may not reflect what a real visitor would later be shown. The registration timeline adds to the concern. The archive holds captures from early 2025, well before the current registration date, which is consistent with a lapsed and re-registered domain. The domain's provenance is therefore not continuous, and it cannot be assumed that today's operator is the party behind the earlier captures. Evidence:

• Homepage and domain reputation: multiple major security engines flag the domain as malicious, and an external blacklist hit is confirmed.
• Domain registration: created 2026-07-28 (about 0.25 years old), with expiry set for 2027-07-28.
• Web archive: 7 snapshots spanning 2025–2026 (2 years tracked, first seen 2025-01-14, last seen 2026-02-14). These predate the current registration date.
• Sandbox behavior on the homepage: 3 of 3 runs succeeded, with no external requests, console errors, or wallet-related activity.

Regulatory Verification Notes

The homepage identifies no operating company, registered address, licensing status, or regulator. Registration details are incomplete, which amounts to ownership opacity, and the operator's real-world identity could not be independently connected to any brand or person. For a service that implies compliance or AML expertise, this absence of corporate and regulatory disclosure is notable. No third-party broker or regulator record matched the domain, so there is no external confirmation of authorization. The missing disclosures are a transparency gap in their own right. The blacklisting makes them far more consequential than they would be on an otherwise clean site. Evidence:

• Homepage: no company name, registration number, license, or regulator reference is published.
• Registrar of record is NICENIC INTERNATIONAL GROUP CO., LIMITED, and the registrant details are incomplete.
• Transport encryption: the TLS certificate is issued by WE1 at DV level (domain validation only, with no organization vetting), valid to 2026-12-24 with about 58 days remaining.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

No interaction should proceed until the reputation findings are resolved. Anyone who still wants to evaluate the service should first confirm independently whether a legally registered company operates it, using official corporate and financial-regulator registries rather than anything stated on the site. Any claimed AML or compliance credentials should be checked directly with the issuing body, and official support channels should be confirmed through an independent route. The current security-vendor classifications should also be re-checked later, since a clean result would be needed to change this assessment. Evidence:

• Homepage: no verifiable credential or registry reference is available to check.
• Domain registration is only months old, and the archive predates it, so the operator's continuity cannot be confirmed from the site itself.
• Security-vendor malicious classifications are current at the time of analysis.

Summary Verdict

The assessment is critical and clearly cautionary. Confirmed external blacklisting, together with a registration history that does not line up with the archived record and an operator whose identity could not be established, places this domain in the highest-risk tier. Neutral runtime behavior and a valid encryption certificate are not enough to counterbalance the threat classifications.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All observed addresses are edge servers, and the origin host is not visible. This is a mitigating factor only, because it shows the site is not hosted on obviously disreputable infrastructure. It also prevents independent verification of the true host and can mask rapid content changes. Protective infrastructure cannot offset the reputational risk here.

Closing Assessment

The domain should be treated as unsafe for any sensitive use. Do not log in, submit credentials or wallet addresses, connect a wallet, or make payments. Limit any contact to passive, read-only viewing from an isolated environment, and prefer an established, independently verified AML screening provider instead.