riskcheck[.]info

Analysis of the domain riskcheck.info indicates active brand impersonation targeting AMLBot, a crypto compliance platform. The domain was registered on November 16, 2025, and remains operational as of July 12, 2026. Infrastructure analysis reveals it resolves to the IP address 198.18.1.48, hosted through Cloudflare, Inc. The page title, 'AML Check - The full-fledged crypto compliance solution,' closely mirrors the branding and service description of AMLBot, suggesting an intent to deceive users seeking legitimate compliance tools. Threat intelligence sources provide concrete evidence of malicious classification. The domain appears in 26 AlienVault OTX pulses and is blocked by at least two security blocklists, including PhishDestroy and BLP-Malware. Gridinsoft assigns a trust score of 0/100, further signaling high risk. While no detections were reported by the 95 vendors that scanned the domain on VirusTotal, this absence does not confirm safety, particularly given the domain's presence on multiple blocklists and its association with known threat intelligence pulses. Defenders should treat this domain as a confirmed impersonation threat. Organizations using AMLBot or similar compliance services are advised to block access to riskcheck.info at the network level and monitor for any attempts to interact with it. Users should be alerted to the risk of credential theft or fraudulent transactions if this domain is accessed. Further investigation into the hosting infrastructure and any associated payment or data collection mechanisms is recommended to assess the full scope of the threat.