MalwareTips, citing Malwarebytes, lists search-aml.net among fake AML checker sites that trick crypto users into wallet approvals, fees or recovery-phrase entry.
Source: malwaretips.com · published
MalwareTips published an investigation on 6 November 2026 of the fake AML checker scam, which uses a protective-sounding anti-money-laundering wallet check to draw people toward dangerous wallet authorisations, clearance-fee payments or recovery-phrase requests. It notes that in an August 2026 report Malwarebytes identified the domains amlbot-clear.com, audittrust.shop, bitget-aml.com, search-aml.net and swapstoken.app as warning indicators for this scheme. This entry covers search-aml.net.
MalwareTips explains that AML stands for anti-money laundering, and that checking a public wallet address is a read-only lookup that does not require handing over control of the wallet. A public address can be screened without connecting a wallet, signing anything or sharing a recovery phrase. AMLBot, a legitimate screening company, warns about cloned platforms and says its screening does not require connecting your wallet; AMLBot is impersonated by some copies and is not involved.
The scheme uses reassurance rather than an unbelievable prize. A visitor who wants to check whether their own funds are clean is asked to connect a wallet, and the site learns which account is in front of it. Malwarebytes documented fake checkers that used this information to tailor the next request. The next prompt may ask the user to approve an unfamiliar contract to spend tokens, pay a fee to clear a warning or unlock a result, or enter a recovery phrase, private key or wallet password. Repeated confirmations without clear explanations are a strong warning sign.
MalwareTips stresses that opening a page, connecting an account, approving token access and sending funds are different events. Someone knowing your public address is not the same as someone knowing your recovery phrase. Check wallet activity and blockchain records rather than the website's final message. If a token approval was granted, revoke it through a trusted approval-management tool; if a recovery phrase was entered, move any remaining assets to a new wallet created on a clean device.
MalwareTips investigation, 6 November 2026: https://malwaretips.com/blogs/fake-aml-checker-scam-wallet-approval-trap/
MalwareTips, citing Malwarebytes, lists swapstoken.app among fake AML checker sites that trick crypto users into wallet approvals, fees or recovery-phrase entry.
MalwareTips, citing Malwarebytes, lists bitget-aml.com among fake AML checker sites that trick crypto users into wallet approvals, fees or recovery-phrase entry.
MalwareTips, citing Malwarebytes, lists audittrust.shop among fake AML checker sites that trick crypto users into wallet approvals, fees or recovery-phrase entry.
MalwareTips, citing Malwarebytes, lists amlbot-clear.com among fake AML checker sites that trick crypto users into wallet approvals, fees or recovery-phrase entry.