check-wallet[.]lat

This domain, check-wallet.lat, was registered on 21 February 2026 through NameSilo, LLC and is currently taken offline. The site resolves to the IPv4 address 108.165.164.250, which belongs to AS210457 Kyonix Networks Limited and is geolocated in Germany. No TLS certificate is presented for the host, indicating that communications would occur over plain HTTP if the site were active. The page title returned by the server is “AML Check”, and the domain is classified as a crypto‑scam that impersonates the AMLBot brand. Threat intelligence shows the domain appears on a single security blocklist and has been blocked by PhishDestroy.

VirusTotal analysis recorded detections from two of ninety‑five scanning engines, confirming that at least a minority of security vendors consider the host malicious. The authoritative name servers are ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com. Available evidence confirms the domain’s registration date, hosting infrastructure, lack of encryption, and its association with AMLBot impersonation. However, the content of the landing page, HTTP response codes, and any credential‑ harvesting mechanisms have not been captured, leaving the exact malicious workflow uncertain. No Safe Browsing, Open Threat Exchange, or additional blocklist entries are currently reported.

Defenders should add check-wallet.lat to DNS‑based deny lists and firewall egress rules, as well as block the associated IP 108.165.164.250 to prevent accidental connections. Email security gateways should be configured to flag messages referencing the “AML Check” title or AMLBot branding. Continuous monitoring of the domain’s DNS records is advised in case the registrar reactivates the name or points it to a new host. Correlating internal logs for any outbound connections to this IP or attempts to resolve the domain will aid in detecting residual infection or inadvertent user access.