amlchecks[.]net

This domain is flagged as a high-risk generic phishing threat and remains active as of July 12, 2026. The domain amlchecks.net was registered on June 24, 2026 through Cloudflare, Inc., a registrar commonly used for both legitimate and malicious domains. The page title observed is AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check. Infrastructure analysis shows the domain resolves to IP address 172.67.195.142 and utilizes Cloudflare services including Cloudflare Browser Insights and HTTP/3. The SSL certificate is issued by Google Trust Services. Threat intelligence sources indicate significant malicious associations. VirusTotal reports that 13 of 95 security vendors flag this domain as malicious. AlienVault OTX lists the domain in 14 threat intelligence pulses. It appears on two security blocklists maintained by PhishDestroy and OISD. Gridinsoft assigns a trust score of 0 out of 100. Defenders should treat this domain as actively hostile and block all outbound connections to 172.67.195.142 and amlchecks.net. It is uncertain whether the site hosts a live phishing kit or performs credential harvesting without further payload analysis. Security teams should inspect network logs for any prior connections to this domain and monitor for related infrastructure sharing the same registrar or IP range. The exact nature of the phishing campaign and any targeted brands require additional investigation. No further details about the page content, visual design, or targeted platforms are available from current intelligence. The high detection rate across multiple vendors and inclusion in multiple OSINT pulses strongly support classification as a confirmed phishing domain.