aml-checks[.]app

Analysis indicates that the domain aml-checks.app is actively flagged as a high-risk crypto phishing operation. The domain resolves to 104.21.66.244, an IP address hosted on AS13335 (Cloudflare, Inc.) in the United States. Infrastructure review shows Cloudflare nameservers (alexa.ns.cloudflare.com, clay.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), consistent with many phishing campaigns leveraging Cloudflare’s proxy services to obscure origin servers. The domain was registered through Dynadot LLC, a registrar frequently associated with fraudulent activity. Detection data reveals the domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. A single security vendor on VirusTotal has flagged the domain, though broader consensus remains limited. The page title, 'AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check,' suggests an attempt to impersonate a legitimate cryptocurrency compliance service, aligning with the classified scam type of 'Crypto Scam.' The HTTP status code 521 indicates a server-side issue, which may reflect takedown efforts or temporary misconfiguration, though the domain remains active as of July 12, 2026. Defenders should treat this domain as malicious and prioritize blocking it at the DNS or network level. Given the Cloudflare proxy, origin server details are obscured, limiting further infrastructure analysis. The use of HTTP/3 and Cloudflare technologies does not inherently indicate legitimacy but rather common phishing tactics to evade detection. No additional brand impersonation details or specific attack vectors are confirmed beyond the page title and scam classification. Monitoring for related domains registered through Dynadot or resolving to the same IP may help identify broader campaign infrastructure.