check-aml[.]site

This domain, check-aml.site, is identified as a crypto drainer phishing campaign impersonating AML Bot, a legitimate anti-money laundering compliance service. Analysis indicates the site employs deceptive branding to trick users into connecting cryptocurrency wallets, facilitating unauthorized fund transfers. The page title explicitly displays 'AML Bot,' suggesting an attempt to exploit trust in the legitimate service to execute fraudulent transactions. No specific drainer kit signatures were conclusively identified, though the use of Vue.js and Cloudflare infrastructure aligns with common phishing toolchains observed in similar campaigns. Infrastructure analysis reveals the domain was registered on March 30, 2026, through Web Commerce Communications Limited dba WebNic.cc, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.96.3, which is part of a network range historically linked to phishing and malicious hosting. At the time of assessment, the domain was detected by 14 out of 95 security vendors on VirusTotal, indicating moderate but not universal recognition. It appears on two independent security blocklists, further corroborating its malicious classification. No Google Safe Browsing (GSB) hits were recorded, suggesting either recent activation or evasion of GSB detection mechanisms. The domain has since been taken offline, likely in response to security vendor detections and blocklist inclusions. However, the elevated risk level persists due to the domain's recent registration date, which may indicate an attempt to evade reputation-based filters. Users who interacted with the site prior to its takedown remain at risk of wallet compromise and should immediately revoke any connected wallet permissions. Organizations are advised to monitor for similar domains registered via WebNic.cc or resolving to the same IP range, as additional campaigns may emerge. Proactive blocklisting of the IP and registrar-based domains is recommended to mitigate further exposure.