Is aml-riskscore.info a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents itself as "AML Check", a crypto compliance and risk-scoring service that describes itself as a full-fledged solution for anti-money-laundering screening. Its homepage is a single text-heavy landing page. The apparent business model is a paid or lead-generating compliance product aimed at crypto businesses and users who need wallet or transaction risk assessments.

Scam/Impersonation Risk

This is the decisive area of concern. Multiple independent security vendors currently classify the site as malicious, and the site is subject to a confirmed blacklist. The detections come from several well-established vendors, so they do not look like an isolated or noisy result. The detection pattern is severe enough to override every favorable technical attribute. The evidence does not say what the vendors detected, and it does not show direct brand impersonation or conflicting legal identities. The browser-protection list did not flag the site. The threat concern therefore rests on the third-party detections, not on a demonstrated impersonation of a named institution. The positioning is itself a risk factor. A compliance and "risk score" product asks visitors to hand over wallet addresses, business details or payments to a service that is trying to look like a trust authority. A newly registered domain with those characteristics fits a trust-themed lure pattern. Behavioural testing of the homepage showed no hidden forms, wallet-connection prompts, clipboard tampering, cloaking or off-site data transmission. That lowers the likelihood of an active drainer on the landing page. It does not offset the blacklist, because harmful behaviour can sit behind interactions the testing did not reach, or be introduced later. Evidence:

• Homepage: 15 security engines flagged the domain as malicious and 1 as suspicious, including several leading vendors, and a confirmed blacklist is active.
• Homepage behavioural testing across 3 successful runs: no external requests, no wallet-connection activity, no hidden forms and no cloaking observed, with 3 console errors recorded.
• Domain registration: created 2026-06-15 (~0.37 years old) through NICENIC INTERNATIONAL GROUP CO., LIMITED, expiring 2027-06-15.
• Web archive: 1 snapshot, first and last seen 2026-07-04, covering 1 year tracked, so there is no established history.

Regulatory Verification Notes

The material reviewed does not show a licensed or registered entity behind the service. No regulator reference or third-party regulatory confirmation was found, and no broker-reputation record matched. Disclosure of the operating company on the site is unclear, and ownership details are incomplete. For a service that sells compliance and AML scoring, this is a material transparency gap, because credibility in that sector depends on a verifiable corporate identity and appropriate registration. By itself the gap does not prove wrongdoing. Here it compounds the threat detections, and identity has not been independently verified. The apparent technical hygiene (valid certificate, resolvable hosting) shows only that the site is operational. Evidence:

• Homepage and available site pages: no verifiable operator identity or licensing reference could be established.
• Transport encryption: TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-09 with 72 days remaining. A DV certificate confirms control of the domain, not the operator's identity.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Before any engagement, the claimed operator should be identified through a source independent of the site, such as a corporate registry or the relevant financial or virtual-asset regulator. Any claim to be a compliance provider should be checked against that registry directly. The vendors' current listing status should be re-checked, and any remediation or delisting statement should be confirmed independently. Official support and contact channels should be confirmed through an offline or otherwise independent route. Claims of partnerships, customers or certifications should be treated as unverified until the named parties confirm them. Evidence:

• Registration history: a domain about four and a half months old with a single archive capture provides no track record to rely on.
• Homepage: the compliance-solution positioning and its claims are asserted by the site only, with no independent corroboration in the evidence.
• Threat listings: the blacklist and malicious detections are current and must be cleared before any reassessment.

Summary Verdict

The site carries an elevated risk posture. Confirmed adverse third-party detections dominate the assessment, and the site's youth and unverified operator identity leave nothing substantive to counterbalance them. The evidence supports caution, not an assumption of legitimacy.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall, and all observed addresses are edge servers, so the origin host cannot be independently identified. That is a mitigating factor only, because the protective layer neither vouches for the operator nor offsets the threat detections. Edge-only visibility also limits independent hosting verification and can mask rapid content changes.

Closing Assessment

Interaction should be limited to passive, read-only viewing. No credentials, wallet addresses, personal or corporate data, or payments should be submitted, and nothing should be downloaded from the site. Reassessment is appropriate only after the threat listings clear and the operator is independently verified.