chek-aml[.]com

The domain chek-aml.com was registered on March 06, 2026 through NiceNIC International Group Co., Limited. Its authoritative name servers are lisa.ns.cloudflare.com and nico.ns.cloudflare.com, indicating that the domain is served via Cloudflare's network. DNS resolution points to IP address 104.21.48.241, which belongs to AS13335 Cloudflare, Inc. and geolocates to the United States. No TLS certificate is presented for the site, suggesting that HTTP connections are either unavailable or unencrypted. The HTTP response observed prior to takedown returned a page whose title field contains the text “AML Bot”, matching the claimed target brand AMLBot and confirming the campaign’s classification as a brand‑impersonation crypto scam.

VirusTotal analysis recorded 2 detections out of 94 scanning engines, and the domain is listed on a single security blocklist. PhishDestroy has also flagged and taken the domain offline. The current status is reported as offline, and no further content is reachable for deeper forensic examination. Analysis indicates that the attacker leveraged Cloudflare’s free DNS and CDN services to mask the true hosting environment, a common tactic for rapid deployment of malicious domains. The lack of an SSL certificate may have been intentional to avoid HTTPS warnings, or the site may have been removed before a certificate could be provisioned.

While the limited detection count suggests a low level of automated detection, the presence on a reputable blocklist and the explicit brand impersonation demonstrate a credible threat vector. Uncertainty remains regarding the full payload, command‑and‑control infrastructure, or any credential‑harvesting mechanisms that might have been hosted at the URL, as the site is no longer reachable. Defenders should continue to block the IP address 104.21.48.241 and add chek-aml.com to local deny lists.