amlchecker-bot[.]com

Analysis of the domain amlchecker-bot.com, observed as offline as of July 24, 2026, indicates a crypto‑related brand impersonation campaign targeting Solana users. The domain was registered on April 08, 2025 through Web Commerce Communications Limited and resolves to the Cloudflare IP address 104.21.64.1, which is announced under ASN 13335 and located in the United States. The authoritative nameservers listed are BRENDA.NS.CLOUDFLARE.COM and IVAN.NS.CLOUDFLARE.COM, confirming the use of Cloudflare’s DNS service. No TLS certificate was presented, meaning the site operated without HTTPS encryption. The page title returned from the site, “Aura Coin on Solana,” aligns with the declared brand target of Solana and the classification of a crypto scam.

Reputation services assign a trust score of 1 out of 100, reflecting extreme distrust. Virus scanning services flagged the domain on two of ninety‑five engines, and the domain appears on a single security blocklist. It has also been added to the PhishDestroy blocklist, indicating that at least one anti‑phishing provider has taken active mitigation steps. The limited detection footprint suggests a brief operational window, likely curtailed by takedown actions.

Uncertainty remains regarding the full scope of the campaign, such as the presence of additional phishing pages, the distribution vectors used, or any associated malware payloads, as no further content analysis is available. Defenders should continue to monitor DNS queries for the 104.21.64.1 address and the associated Cloudflare nameservers, enforce blocklisting of the domain and IP in perimeter defenses, and incorporate the domain hash into threat‑intel feeds. Organizations using Solana wallets should advise users to verify URLs carefully and to avoid interacting with any site presenting “Aura Coin” without official verification. Ongoing vigilance is recommended, as the infrastructure could be repurposed for future impersonation attempts.