# amlcheckings.pro — SUSPICIOUS

> Avoid amlcheckings.pro, a phishing site impersonating AML Scam. This domain is offline but previously risky. Stay alert to protect your info.

## Summary
PhishDestroy identifies amlcheckings.pro as a phishing domain impersonating the AML Scam brand. Although currently offline, this site posed a medium risk by misleading users with a fraudulent page titled "AML Checkings." Such impersonation aims to deceive individuals into trusting the site and potentially submitting sensitive information.

This phishing campaign operated by creating a domain that closely mimics legitimate AML-related services. The site was registered through NiceNIC International Group Co., Limited and resolved to IP 172.67.142.196. It was flagged on one security blocklist and detected by three out of ninety-five VirusTotal security vendors, indicating some recognition of its malicious intent. The domain was created on February 21, 2026, and used an official-sounding page title to lure victims.

If you visited amlcheckings.pro, it is crucial to avoid entering any personal or financial data and to immediately run a comprehensive antivirus and antimalware scan on your devices. Monitor your accounts for suspicious activity and consider changing passwords associated with any potentially compromised credentials. Reporting the incident to your IT security team or relevant authorities can help prevent further exploitation.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Scam type: AML Scam
- Target brand: AML Scam
- Page title: AML Checkings

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 172.67.142.196
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["kipp.ns.cloudflare.com", "gloria.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 3 vendors flagged
  Vendors: ["Gridinsoft", "Seclookup", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019b7fd9-67b0-75a3-884e-31e24f0b81e4.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/722cb623-0d66-407e-8437-03c635729028
- PhishDestroy: https://phishdestroy.io/domain/amlcheckings.pro/
- LLM endpoint: https://phishdestroy.io/domain/amlcheckings.pro/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/amlcheckings.pro/
Last updated: 2026-03-19