# amlcheck.sbs — MALICIOUS

> amlcheck.sbs is a live phishing domain impersonating AML Scam checker tools. VirusTotal flags 5 of 95 vendors; report 93882e shows risks. Check the full report.

## Summary
PhishDestroy identifies amlcheck.sbs as an active brand-impersonation phishing domain masquerading as an anti-money-laundering (AML) validity checker. Visitors who land on the site are presented with fake verification forms that harvest sensitive identity documents and financial data under the guise of confirming AML Scam legitimacy. If entered, the stolen information is immediately transmitted to attacker-controlled servers, enabling identity theft, account takeovers, and fraudulent transactions. This campaign specifically targets users searching for AML Scam validation tools, exploiting their trust in reputable compliance services to deliver malicious payloads.

PhishDestroy’s analysis shows this domain was created on March 11, 2026, just days before the campaign went live. It is registered through Global Domain Group LLC and resolves to IP address 188.114.97.3. A Let’s Encrypt SSL certificate lends false legitimacy to the page, while VirusTotal confirms 5 out of 95 security vendors already flag the site as malicious. These technical indicators reveal a newly stood-up infrastructure designed to evade early detection and capitalize on the urgency around AML Scam validations.

If you visited amlcheck.sbs, immediately disconnect from the internet and close the browser. Scan your device with updated antivirus and security tools to detect any installed malware or stolen credentials. Revoke any passwords you may have submitted and enable multi-factor authentication on all critical accounts. Report the domain to your security team or submit it to PhishDestroy for further investigation. Avoid re-entry; this domain remains active and dangerous.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Target brand: AML Scam

## Domain Intelligence
- Registered: 2026-03-11 01:06:28
- Registrar: Global Domain Group LLC
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 5 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/5790af91-86a4-4bc1-b00c-c702e65889f0
- PhishDestroy: https://phishdestroy.io/domain/amlcheck.sbs/
- LLM endpoint: https://phishdestroy.io/domain/amlcheck.sbs/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/amlcheck.sbs/
Last updated: 2026-03-21