---
title: "Is aml-guard.net a Scam? Trust Score 5/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "aml-guard.net"
verdict: "Critical Risk"
title: "Is aml-guard.net a Scam? Risk Report, Score 5/100"
trust_score: 5
classification_confidence: 70
canonical_url: https://trustsniffer.com/report/aml-guard.net
assessed: 2026-10-27
---

# Is aml-guard.net a scam? TrustSniffer's high-risk assessment: 5/100

## Verdict


**Verdict: Critical Risk, trust score 5/100.** aml-guard.net shows high-risk / scam indicators.

This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-27 by automated analysis. Classification confidence 70%.

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 18 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 0% confidence (AbuseIPDB, 0 reports; shared hosting inflates reports) | Clear |
| Domain age | 1.8 years old (Registered history) | Clear |
| Web archive | Archived since 2025 (7 snapshots) | Clear |
| Certificate | Encrypted connection (Issued by WE1) | Noted |

## The page as captured


![Screenshot of the aml-guard.net homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/aml-guard.net/screenshots/first.png)

_What aml-guard.net served when TrustSniffer captured it on 2026-10-27. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- Domain age: 1 to 3 years (registration continuity).
- Public web-archive history exists since 2025.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.

## Full analysis


### Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at aml-guard.net presents itself, through its page title and single-page homepage, as a "Web3 AML Checker", an anti-money-laundering screening utility aimed at cryptocurrency and blockchain users. It is a lightweight, text-based landing page rather than a multi-page corporate site. Its apparent purpose is to offer compliance-style address or transaction screening, a service category where visitors are typically prompted to submit wallet addresses or sensitive financial details.


### Scam/Impersonation Risk

Material contradictory signals are present. The domain is **blacklisted** by external threat-intelligence sources, and several leading security vendors independently flag it as malicious. That convergence is the decisive factor in this assessment and outweighs everything favorable on the site. The compliance-flavored branding ("AML", "Guard") is also a recognized lure pattern. A site that appears to offer protection or screening in the crypto space can gain credibility it has not earned. No brand impersonation or conflicting legal-entity names were identified. The homepage raised no wallet-connection, clipboard-manipulation, hidden-form, or cloaking behavior in sandboxed testing, and it made no external network calls. Those clean runtime results do not offset the third-party malicious classification. The browsing sessions may not reflect what a real visitor would later be shown. The registration timeline adds to the concern. The archive holds captures from early 2025, well before the current registration date, which is consistent with a lapsed and re-registered domain. The domain's provenance is therefore not continuous, and it cannot be assumed that today's operator is the party behind the earlier captures. Evidence:

- Homepage and domain reputation: multiple major security engines flag the domain as malicious, and an external blacklist hit is confirmed.
- Domain registration: created 2026-07-28 (about 0.25 years old), with expiry set for 2027-07-28.
- Web archive: 7 snapshots spanning 2025–2026 (2 years tracked, first seen 2025-01-14, last seen 2026-02-14). These predate the current registration date.
- Sandbox behavior on the homepage: 3 of 3 runs succeeded, with no external requests, console errors, or wallet-related activity.

### Regulatory Verification Notes

The homepage identifies no operating company, registered address, licensing status, or regulator. Registration details are incomplete, which amounts to ownership opacity, and the operator's real-world identity could not be independently connected to any brand or person. For a service that implies compliance or AML expertise, this absence of corporate and regulatory disclosure is notable. No third-party broker or regulator record matched the domain, so there is no external confirmation of authorization. The missing disclosures are a transparency gap in their own right. The blacklisting makes them far more consequential than they would be on an otherwise clean site. Evidence:

- Homepage: no company name, registration number, license, or regulator reference is published.
- Registrar of record is NICENIC INTERNATIONAL GROUP CO., LIMITED, and the registrant details are incomplete.
- Transport encryption: the TLS certificate is issued by WE1 at DV level (domain validation only, with no organization vetting), valid to 2026-12-24 with about 58 days remaining.
- Hosting: served from AS13335 (Cloudflare, Inc., US).

### What to Verify Next

No interaction should proceed until the reputation findings are resolved. Anyone who still wants to evaluate the service should first confirm independently whether a legally registered company operates it, using official corporate and financial-regulator registries rather than anything stated on the site. Any claimed AML or compliance credentials should be checked directly with the issuing body, and official support channels should be confirmed through an independent route. The current security-vendor classifications should also be re-checked later, since a clean result would be needed to change this assessment. Evidence:

- Homepage: no verifiable credential or registry reference is available to check.
- Domain registration is only months old, and the archive predates it, so the operator's continuity cannot be confirmed from the site itself.
- Security-vendor malicious classifications are current at the time of analysis.

### Summary Verdict

The assessment is **critical and clearly cautionary**. Confirmed external blacklisting, together with a registration history that does not line up with the archived record and an operator whose identity could not be established, places this domain in the highest-risk tier. Neutral runtime behavior and a valid encryption certificate are not enough to counterbalance the threat classifications.


### Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All observed addresses are edge servers, and the origin host is not visible. This is a mitigating factor only, because it shows the site is not hosted on obviously disreputable infrastructure. It also prevents independent verification of the true host and can mask rapid content changes. Protective infrastructure cannot offset the reputational risk here.


### Closing Assessment

The domain should be treated as unsafe for any sensitive use. Do not log in, submit credentials or wallet addresses, connect a wallet, or make payments. Limit any contact to passive, read-only viewing from an isolated environment, and prefer an established, independently verified AML screening provider instead.


_Written analysis generated 2026-10-27 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

3 findings contributed to this verdict, raised by governance, external reputation, registration and ownership.

### 01 Governance
- A threat feed lists this domain as malicious, and that caps the score whatever the other checks found. (Governance `rule:GOV_CRITICAL_BLACKLIST`)

### 02 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`)

### 03 Registration and ownership
- The public registration record for this domain is incomplete. (Registration and ownership `rule:KF_WHOIS_INCOMPLETE`)

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNKNOWN |
| Identity score | 50/100 |
| Identity verification confidence | 30% |

- AI page analysis unavailable (page captured; identity not AI-verified)

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of aml-guard.net.

- The request stayed on aml-guard.net. It was not redirected to another domain. (Clear)
- Registration is published under NICENIC INTERNATIONAL GROUP CO., LIMITED. (Clear)
- DNS for this domain is served by cloudflare.com, across 2 name servers. (Noted)
- The registration is paid up to 2027-07-28. (Noted)
- The earliest public archive of this site is from 2025-01-14. (Clear)
- It is hosted on CLOUDFLARENET, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3032::6815:26f2 |
| Name servers | ARELY.NS.CLOUDFLARE.COM, DAVID.NS.CLOUDFLARE.COM |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-12-24 |
| Domain age | 1.78 years (continuous registration) |
| Domain expiry | 2027-07-28 |
| Archive first seen | 2025-01-14 |
| Archive snapshots | 7 |
| Reputation | VirusTotal: 18 flagged \| AbuseIPDB: 0% confidence, 0 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about aml-guard.net at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [deckardsdreams.net](https://trustsniffer.com/report/deckardsdreams.net), another .net site assessed as critical-risk (Critical Risk, 0/100)
- [ekopellet.net](https://trustsniffer.com/report/ekopellet.net), another .net site assessed as critical-risk (Critical Risk, 0/100)
- [chainconnector.net](https://trustsniffer.com/report/chainconnector.net), another .net site assessed as critical-risk (Critical Risk, 1/100)
- [aml-radar.net](https://trustsniffer.com/report/aml-radar.net), another .net site assessed as critical-risk (Critical Risk, 0/100)
- [cryptomuspay.net](https://trustsniffer.com/report/cryptomuspay.net), another .net site assessed as critical-risk (Critical Risk, 0/100)
- [bawsaq.net](https://trustsniffer.com/report/bawsaq.net), another .net site assessed as critical-risk (Critical Risk, 0/100)
- [skin-port.net](https://trustsniffer.com/report/skin-port.net), another .net site assessed as critical-risk (Critical Risk, 0/100)
- [super-bridge.net](https://trustsniffer.com/report/super-bridge.net), another .net site assessed as critical-risk (Critical Risk, 5/100)
- [hdbkell.com](https://trustsniffer.com/report/hdbkell.com), another site assessed as critical-risk (Critical Risk, 0/100)
- [kenwillzltd.com](https://trustsniffer.com/report/kenwillzltd.com), another site assessed as critical-risk (Critical Risk, 0/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [Stablecoin Freezes, Oct 26, 2026: 11 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-26)
- [99.5% of flagged USDT wallets were frozen](https://trustsniffer.com/blog/99-5-of-flagged-usdt-wallets-were-frozen)
- [Trading Platform Scam: Checking a Blocked Balance](https://trustsniffer.com/blog/trading-platform-scam-checking-a-blocked-balance)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/aml-guard.net) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/aml-guard.net · assessed 2026-10-27.*