amlchecker[.]digital

The domain amlchecker.digital was observed serving an investment‑fraud landing page with the title “Nur einen Moment…”. The site resolves to the IP address 172.67.147.250, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was presented, indicating the site was accessed over plain HTTP. Registration data show the domain was created through Web Commerce Communications Limited doing business as WebNic.cc, and the authoritative name servers are ns100.webnic.cc and ns101.webnic.cc.

Independent threat‑intel feeds have placed the domain on at least one security blocklist, and PhishDestroy has already taken the site offline. VirusTotal scans reported nine positive detections out of ninety‑five scanners, confirming malicious intent consistent with the investment‑scam classification supplied in the intelligence. The combination of a Cloudflare edge IP, lack of encryption, and rapid blocklist inclusion suggests a short‑lived, opportunistic campaign that leverages free hosting to hide behind a reputable CDN.

While the exact phishing kit or compromised credentials have not been disclosed, the observed indicators are sufficient to flag the domain as malicious. Defenders should add amlchecker.digital to blocklists, enforce DNS sinkholing or firewall deny rules for the resolved IP, monitor for any newly‑registered subdomains under the same registrar, and update web‑proxy filtering policies to reject traffic to the domain and its associated IP. Continuous re‑inspection of the IP range 172.67.147.0/24 is advised, as Cloudflare often serves multiple unrelated malicious payloads from adjacent addresses.