checkaml[.]co

This domain, checkaml.co, is flagged as a brand-impersonation threat targeting AMLBot, a cryptocurrency anti-money laundering verification service. The site presents itself as a legitimate AML checking platform with the page title 'Check AML,' designed to harvest user credentials or sensitive financial data under false pretenses. Infrastructure analysis reveals no direct association with known drainer kits, but the domain exhibits technical indicators consistent with phishing infrastructure, including the use of Vercel hosting and HSTS enforcement to appear legitimate. Technical indicators confirm elevated risk: the domain is detected by 3 of 95 security vendors on VirusTotal, registered through GoDaddy.com, LLC on September 18, 2025, and resolves to the IP address 216.198.79.1. It holds a Gridinsoft trust score of 0/100 and a Scamadviser score of 37/100, with one security blocklist flagging it as malicious. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, and the domain was actively blocked by PhishDestroy prior to takedown. As of the latest assessment, checkaml.co has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk remains for users who may have interacted with the domain during its active period. Organizations should monitor for unauthorized access attempts linked to credentials obtained via this site and consider implementing additional verification steps for AML-related services. Network defenders are advised to block the domain and associated IP at perimeter controls to prevent potential re-emergence or related infrastructure reuse.