aml-checks[.]net

This domain, aml-checks.net, is actively impersonating a cryptocurrency compliance service, as indicated by its page title 'AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check.' Registered on August 22, 2025, through Dynadot LLC, the domain resolves to IP 188.114.97.3, hosted on Cloudflare infrastructure (AS13335). Analysis reveals the use of Cloudflare nameservers (alexa.ns.cloudflare.com, clay.ns.cloudflare.com) and HTTP/3 protocol, with a current HTTP status of 521, suggesting potential server-side issues or deliberate evasion tactics. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains leveraging Cloudflare. The domain is flagged by one security vendor on a blocklist, with additional low trust scores from Gridinsoft (0/100) and Scamadviser (26/100). While VirusTotal shows a single detection out of 95 vendors, this does not provide conclusive evidence of malicious activity but aligns with the broader pattern of brand impersonation targeting cryptocurrency users. The scam type is classified as cryptocurrency-related, though specific tactics (e.g., credential harvesting, wallet drainers, or fake compliance tools) remain unconfirmed due to limited page content analysis. Defenders should prioritize blocking or monitoring this domain, particularly in environments handling cryptocurrency transactions or compliance checks. The use of Cloudflare infrastructure may complicate takedown efforts, but the domain's registration details and hosting provider (Dynadot) could serve as additional pivot points for mitigation. Further investigation into associated IPs, subdomains, or linked infrastructure is recommended to assess the full scope of this campaign.