amlcheckcrypto[.]org

Analysis of amlcheckcrypto.org indicates that the domain was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline. The site presented the page title “AMLBot – Advanced Wallet Analysis,” which aligns with a wallet/seed phishing campaign that impersonates the brand “across.” The domain is listed on a single security blocklist and is explicitly blocked by PhishDestroy, confirming its classification as a malicious resource. SSL inspection shows the certificate identifier “WE1,” but no further validation data is provided.

Reputation scoring from Gridinsoft assigns a score of 0 out of 100, reflecting an extremely low trust level. VirusTotal scanning returned a single positive detection out of 93 participating vendors, indicating at least one security engine identified malicious characteristics. The limited detection footprint suggests the payload may be newly deployed or that the malicious components evade many scanners, but the presence of any detection is sufficient to warrant caution.

No additional IP, ASN, or geographic information is available in the supplied intelligence, and the HTTP response status is not recorded because the site is offline. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection of the host, and incorporate the indicator set—domain name, registration details, SSL identifier, and page title—into threat‑intel feeds. Ongoing observation of blocklist updates and VirusTotal re‑scans is recommended to capture any changes in detection coverage.