# PhishDestroy threat dossier — amlscan.zip ================================================================ Fetched: 2026-05-20 13:23:17 UTC Canonical: https://phishdestroy.io/domain/amlscan.zip/ ## VERDICT ---------------------------------------------------------------- STATUS STALE — last probed 50 days ago, treat as ACTIVE until re-verified Composite threat score: 78/100 (PhishDestroy scoring — see methodology below) Scam classification: cryptocurrency Targeted brand: AML Scam ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/93 security vendors flagged this domain Flagging vendors: Gridinsoft Public blocklists: listed on 2 independent blocklists Victim re-reports (public form): 1 ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 138.124.67.249 (NL, Kerkrade) ASN: ASAS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP Hosting org: AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP Registrar: Tucows Domains Inc. Nameservers: ["1-you.njalla.no", "2-can.njalla.in", "3-get.njalla.fo"] Registered: 2026-02-21 Expires: 2027-01-21 Page title: Crypto AML Check - Cryptocurrency Transaction Monitoring Solution | Sumsub ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-04-21 Status: INVALID chain Fingerprint: a274a96a492f358f6923dceab84cd26cad0b9cf4d801ce3d187c5ef0cda514a5 Subject Alternative Names (related infrastructure — often same operator): - www.amlscan.zip ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-02-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-25 02:39:27 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-02-10 18:20:26 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-03-31 01:20:54 UTC (STALE — 50 days ago, re-verify) Flagged dead: 2026-03-16 00:04:32 UTC (NOT RE-VERIFIED IN 50 DAYS — treat as unconfirmed) Current status: UNCONFIRMED (our live-probe is 50 days stale) Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019c48bf-b263-770d-be99-70f04a1c2f6e/ URLQuery: https://urlquery.net/report/9b2aa41c-1650-4155-bdb0-3f96ecb6dfb8 Wayback Machine: https://web.archive.org/web/*/amlscan.zip crt.sh CT logs: https://crt.sh/?q=%25.amlscan.zip Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=amlscan.zip AlienVault OTX: https://otx.alienvault.com/indicator/domain/amlscan.zip URLhaus: https://urlhaus.abuse.ch/host/amlscan.zip/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-03-19 15:37:02 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain amlscan.zip presents an elevated risk due to confirmed brand impersonation targeting AML Scam. This threat specifically aims to deceive users into providing cryptocurrency credentials or sensitive information through a fake cryptocurrency transaction monitoring solution interface. Multiple security indicators confirm the malicious nature of this domain. VirusTotal shows 1/95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain was registered through Tucows Domains Inc. on February 21, 2026, and resolves to IP address 138.124.67.249. Security blocklists PhishDestroy and ScamSniffer have identified and blocked this threat. The site utilizes React and Nginx technologies, with a PageSpeed performance score of 39/100 suggesting hasty deployment typical of phishing operations. Users encountering amlscan.zip should immediately avoid interacting with the site and not enter any credentials or personal information. Report the domain to security platforms and warn others about this specific AML Scam impersonation attempt. Since the domain is currently offline, monitor for potential reactivation attempts and verify any cryptocurrency transaction monitoring services through official AML Scam channels only. [Updates since narrative was generated:] - VirusTotal detections: now 1/93 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260210-E1F7DD Favicon SHA-256: 5f80d8985a0236e5cad684ead3faa417b6d2b80c8bc84ebe63864eb7b819f61e TLS cert SHA-256: a274a96a492f358f6923dceab84cd26cad0b9cf4d801ce3d187c5ef0cda514a5 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/amlscan.zip/ JSON API: https://api.destroy.tools/v1/check?domain=amlscan.zip Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 152,024 domains (43,259 alive under monitoring, 108,485 confirmed takedowns/dead). Site: https://phishdestroy.io