amlcheckup[.]net

Analysis of amlcheckup.net indicates that the domain is actively being used for a crypto‑related phishing operation. The site is listed on the PhishDestroy blocklist and appears on one additional security blocklist, confirming its malicious reputation. The domain was registered on February 21, 2026 through the TLD Registry (.net) and resolves to the IP address 185.230.63.171, which is hosted by Wix.com Inc in the United States. An HTTP 301 response is observed, and the TLS certificate is issued by Google Trust Services under the WR1 designation, showing a valid‑looking HTTPS configuration that may be used to lend credibility to the phishing page.

The page title returned from the site is "АМЛ Проверка | Aml Check", but no further content analysis is available. VirusTotal reports that the domain was scanned by 91 antivirus vendors, none of which flagged the site at the time of scanning; this absence of detections does not constitute a safety assurance. A Gridinsoft trust score of 0 out of 100 further emphasizes the low trustworthiness of the domain.

While the exact phishing payload and targeted services remain undocumented, the classification as a crypto scam aligns with the observed intelligence. Defenders should immediately block traffic to amlcheckup.net at network perimeter devices, update endpoint blocklists, and monitor DNS queries for the associated IP address. Continuous re‑scanning with multi‑vendor services is advised to capture any future malicious payloads that may be introduced.