check[.]amlcrystalblockchain[.]com

Analysis of check.amlcrystalblockchain.com confirms its classification as a crypto scam impersonating Blockchain.com, with elevated risk indicators. The domain was registered on February 21, 2026, and resolved to IP 104.21.4.205, hosted on Cloudflare's infrastructure (AS13335). The page title 'AML Check' suggests an attempt to mimic Blockchain.com's anti-money laundering verification processes, aligning with the reported scam type targeting cryptocurrency users.

The domain is currently offline, though its prior operational status was flagged by at least one security vendor (PhishDestroy) and appears on a single blocklist. VirusTotal records indicate one detection out of 93 vendors, reinforcing its malicious classification. The SSL certificate (WE1) is low-trust, and Gridinsoft assigns a trust score of 0/100, further corroborating its fraudulent nature.

While the exact content and functionality of the site remain unanalyzed due to its offline status, the available evidence—including the brand impersonation, scam type, and detection by security tools—supports its designation as a confirmed phishing domain. Defenders should treat this domain as malicious, block access at the network level, and monitor for related infrastructure reuse. No additional indicators of compromise (IOCs) are available at this time.