Is aml-radar.net a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents itself as a "Web3 AML Checker", a single-page service on the aml-radar.net domain. It appears to offer anti-money-laundering style screening for blockchain addresses or wallets, and it targets crypto-asset users and compliance-minded visitors. Its apparent business model is a compliance-themed utility whose real-world operator is not independently identified.

Scam/Impersonation Risk

Contradictory signals are present, and they are serious. Several major security vendors currently flag the domain as malicious, and the aggregate detection volume is high enough that the site is treated as confirmed blacklisted on external threat-intelligence sources. The deterministic assessment also records a known-phishing association for the domain. No conflicting legal entities, no brand impersonation and no identity contradiction were observed, so the risk stems from the external reputation findings rather than from inconsistent on-site claims. The domain was registered only recently. That is typical of throwaway infrastructure in the crypto-compliance niche, where a "checker" brand lends credibility to a page that asks visitors to submit wallet addresses or credentials. Behavioral testing did not observe wallet-drainer activity, clipboard manipulation, hidden forms or external data posts, but those clean runs do not outweigh the independent malicious listings. Evidence:

• Homepage: titled "Web3 AML Checker", with a short body of text and no named operator or company.
• Domain provenance: registered 2026-08-10 (~0.21 years old), well under a year at the time of analysis.
• Reputation: 16 malicious and 3 suspicious detections from external security engines, including several top-tier vendors, which triggered an automatic critical-reputation override.
• Behavioral sandbox: three successful runs on the homepage with no external requests, no wallet-connect attempts and no hidden or external password forms.

Regulatory Verification Notes

The captured homepage identifies no licensed entity, registration number or regulator, and ownership of the domain is opaque. Registration details are incomplete, and nothing on the page supplies a corporate identity to compensate. This is ownership opacity and a governance gap, not an identity contradiction. The site presents itself as an AML-themed service, a category that implies compliance credibility, yet it supplies no verifiable basis for that positioning. No third-party broker or regulatory database match exists for the site. Absence of a match is neutral and does not constitute a regulatory verdict. Evidence:

• Homepage: no company name, licence, registration number or regulator reference is disclosed.
• Domain registration: registered through NICENIC International Group Co., Limited on 2026-08-10, expiring 2027-08-10, with owner details incomplete.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 at domain-validation (DV) level, valid to 2027-01-06 with about 71 days remaining.

What to Verify Next

No verification step can make the site safe for sensitive use while the active threat listings stand. Any decision to engage should rest on independent confirmation that the operator exists, reached through channels not supplied by the site. If the service is claimed to be a licensed compliance or analytics provider, that claim should be tested against the relevant financial-intelligence or virtual-asset-service-provider registry in the claimed jurisdiction. Official support or contact channels should be confirmed through an offline or third-party route. Re-testing should be considered only after the threat listings are formally cleared by the vendors concerned. Evidence:

• Homepage: gives no registry-checkable operator, so any licence claim can only be tested by the visitor from outside the site.
• Domain history: only recently registered, so there is no long operating record to rely on in place of an independent identity check.
• Reputation status: the malicious listings are current, so clearance would have to come from the listing vendors rather than from the site itself.

Summary Verdict

The overall posture is critical and clearly cautionary. Active third-party malicious listings, a very young domain and an unidentified operator converge into an elevated risk assessment that the technically clean behavior and valid encryption do not offset. Legitimacy is not supported, and the site cannot be treated as trustworthy for any sensitive purpose.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall, and all observed addresses are edge servers, so the origin host could not be observed. That is a mitigating factor only. It offers some protection against denial-of-service and basic attacks, but it limits independent hosting verification and can mask rapid content swaps. The certificate is valid, and the young domain has sparse subdomain structure. Neither is a proxy for legitimacy, and neither can offset the external reputation findings.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, address submission or any financial interaction. At most, it should be viewed read-only from an isolated environment. Anyone who has already interacted with it should treat any submitted credentials or approvals as potentially exposed and rotate or revoke them.