aml-check-crypto[.]net

Analysis of aml-check-crypto.net shows that the domain was registered on February 21, 2026 and is currently taken offline. The domain resolves to the IP address 136.243.14.123, which belongs to Hetzner Online GmbH in Germany (AS24940). The hosting provider is therefore a known commercial hosting service, but no further infrastructure details have been disclosed. The site was flagged by the PhishDestroy blocklist and appears on one additional security blocklist, indicating that at least one external sinkhole has identified it as malicious.

The domain was scanned by 95 antivirus and URL scanning vendors on VirusTotal; at the time of analysis none of the vendors reported a detection. While the absence of detections does not constitute evidence of safety, it suggests that the payload or landing page may not yet be recognized by existing signatures. The SSL certificate is labeled "R10," which is a low‑trust rating in common certificate reputation services, further reducing confidence in the site’s legitimacy. The threat classification provided is “Crypto Scam,” implying that the domain was used to lure victims into fraudulent cryptocurrency transactions.

No page title, brand references, Safe Browsing status, OTX mentions, or registrar details are available, leaving the content and exact phishing vector unverified. Defenders should continue to block the domain and its associated IP address, incorporate the domain into internal deny‑list feeds, and monitor for any re‑activation or new DNS resolutions. Additional telemetry such as HTTP response codes, page content hashes, and user‑agent patterns should be collected if the domain reappears, allowing correlation with existing threat intel and improving detection rules for crypto‑related phishing campaigns.