usdt-amlcheck[.]info

This domain is flagged as an elevated-risk brand impersonation threat targeting users of Trust Wallet’s AML screening services. Analysis indicates the site mimics legitimate AMLBot functionality, presenting itself as "AMLBot — Trust Wallet AML Screening" to deceive victims into submitting sensitive wallet or transaction data under false pretenses. The impersonation is designed to exploit users seeking anti-money laundering verification, a common tactic in cryptocurrency scams to harvest credentials or install malicious software. Infrastructure analysis reveals the domain resolves to IP address 104.21.30.100 and employs Cloudflare for hosting and security obfuscation, including HSTS and HTTP/3 protocols. The domain was registered on April 18, 2026, through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar frequently associated with high-risk registrations. Security telemetry shows 5 out of 95 vendors on VirusTotal flag the domain as malicious, and it appears on one active security blocklist. Additional indicators include a Gridinsoft trust score of 0/100 and prior blocking by enterprise phishing detection systems. The domain is currently offline, though historical activity suggests potential for reactivation under similar infrastructure. Mitigation requires immediate blocking of the domain and its resolving IP across all network security controls, including firewalls, DNS filters, and endpoint protection platforms. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, particularly those using Cloudflare with similar page titles or cryptocurrency-related keywords. Users should be educated to verify the legitimacy of AML screening tools by cross-referencing official Trust Wallet or AMLBot domains and avoiding any third-party sites claiming affiliation. Security teams are advised to review logs for connections to 104.21.30.100 or related Cloudflare IPs to identify potential prior exposure.