checkups-aml[.]one

PhishDestroy identifies checkups-aml.one as an active crypto drainer scam designed to trick users into connecting cryptocurrency wallets and drain funds. This domain masquerades as a legitimate AML compliance service, luring victims with promises of account verification or transaction monitoring. Once a user approves a wallet connection, the site executes malicious scripts to transfer funds to attacker-controlled addresses without further confirmation.

This domain was flagged on April 07, 2026, just after creation, and registered through Dynadot Inc. It resolves to IP address 107.189.16.56 and currently shows 0 detections out of 95 scans on VirusTotal, indicating it evades many automated detection systems. The use of a Let’s Encrypt SSL certificate adds a false veneer of legitimacy, but SSL alone does not guarantee safety. The domain’s recent age and clean initial scan make it especially dangerous, as threat actors often register new domains to avoid established blacklists.

If you visited checkups-aml.one and connected a wallet or entered any information, disconnect your wallet immediately and revoke any unauthorized permissions in your wallet settings. Do not approve additional transactions or sign any new messages. Scan your device for malware using reputable security software. Report the domain to PhishDestroy for verification and consider rotating any exposed wallet addresses or private keys. Always verify URLs and services through trusted sources before interacting, especially when dealing with financial or wallet-related websites.