aml-checkup[.]org

This domain, aml-checkup.org, is identified as a brand impersonation threat targeting Anti-Money Laundering (AML) services. Analysis indicates the site was designed to deceive users by presenting itself as a legitimate AML compliance or verification platform, likely to harvest sensitive financial or personal data. No specific drainer kit signatures were detected, but the domain aligns with known patterns of fraudulent AML-related schemes, including fake verification portals and compliance scams. The threat type is classified as brand impersonation, with no direct evidence of cryptocurrency-draining functionality at this time. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 188.114.96.3 and was registered on March 28, 2026, through Gname.com Pte. Ltd. Security vendors on VirusTotal flagged the domain with a detection score of 10/95, indicating moderate consensus on its malicious nature. The domain appears on one security blocklist and is associated with an SSL certificate issued by Google Trust Services. Technologies detected include Cloudflare and Cloudflare Browser Insights, suggesting the use of content delivery and performance optimization tools commonly leveraged to evade detection or enhance credibility. As of the latest assessment, aml-checkup.org has been taken offline, likely due to enforcement actions by security providers or hosting interventions. Despite its current inactive status, residual risk remains for users who may have interacted with the domain prior to its takedown. Organizations and individuals are advised to monitor for unauthorized access attempts or suspicious transactions linked to this domain. Proactive measures, such as reviewing access logs for connections to 188.114.96.3 and educating users on recognizing brand impersonation tactics, are recommended to mitigate potential fallout from this campaign.