automatedkycservices[.]com

PhishDestroy first observed automatedkycservices.com on Apr 11, 2026. Stored content metadata identifies Genericcrypto as the apparent target. The captured page title is “Coinbase AML Scan - Secure Compliance for Crypto”. Stored page analysis classifies the content as aml scam. Current evidence score: 95/100 (critical).

Positive findings are stored from 6 sources: VirusTotal, Spamhaus DBL, DNS security resolvers, Cloudflare Radar, URLQuery, and URLScan. VirusTotal recorded 18 detections among 94 engines: BitDefender, Chong Lua Dao, Cluster25, CyRadar, Ermes, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Netcraft, OpenPhish, SOCRadar, Sophos, VIPRE, Webroot on Jul 18, 2026 at 14:45 UTC. Spamhaus DBL: DBL_PHISH on Jul 13, 2026 at 18:37 UTC. DNS security checks returned 4 blocking results across 12 tested policies: Control D Adblock, Control D Family, Control D Malware, Quad9 Secure; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and assigned the categories security risks, phishing, and security threats; its verdict timestamp was not retained. URLQuery recorded 4 threat-system alerts on Apr 11, 2026 at 17:29 UTC. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Coinbase and assigned phishing as its category on Jul 29, 2026 at 02:42 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 10:20 UTC. Google Safe Browsing returned no flag on Apr 11, 2026 at 18:28 UTC. PhishStats returned no feed match on Apr 11, 2026 at 18:29 UTC.

The collector marked the hostname reachable on Aug 7, 2026 at 22:15 UTC, but did not retain the HTTP response code. Registration records for the domain list Tucows Domains Inc. as the registrar and Apr 11, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 185.95.159.28 on AS209101 (IP Vendetta Inc.). The recorded endpoint location is Victoria, SC. The stored server header is nginx/1.24.0 (Ubuntu). The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Jul 9, 2026; checked Apr 11, 2026 at 20:00 UTC.

The content indicators and 6 positive source findings support the current Genericcrypto-themed aml scam classification.