check-coin[.]com

This domain, check-coin.com, operates as a credential theft platform targeting users of cryptocurrency compliance services. Analysis of the page title, 'Crypto AML Check | Sumsub,' indicates an attempt to impersonate a legitimate anti-money laundering verification provider, likely to harvest user credentials or sensitive financial information under false pretenses. The site mimics the interface and branding of the authentic service, increasing the likelihood of successful deception among users seeking AML compliance checks for crypto transactions. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and was created on April 12, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. It resolves to the IP address 152.232.8.190 and is currently flagged by 2 out of 95 security vendors on VirusTotal, while also appearing on one security blocklist. The domain uses a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy and is commonly exploited in phishing campaigns. Users who have visited check-coin.com or entered credentials on the site should immediately revoke any submitted information and cease all interaction. All passwords or authentication tokens associated with the impersonated service should be changed from a secure, unrelated device. Monitoring for unauthorized transactions or account access is recommended, particularly for cryptocurrency wallets or financial platforms linked to the credentials. Security teams should update blocklists to include the domain and its resolving IP, and users should verify the authenticity of any AML or compliance service by accessing it through official channels only.