amlchecken[.]com

The domain amlchecken.com was registered on February 27, 2026 through NiceNIC International Group Co., Limited and resolved to the Cloudflare address 188.114.97.3 (AS13335, United States). The site presented a page titled “AML Bot” and has been classified as a crypto‑related scam. No TLS certificate was observed, indicating that the site operated without HTTPS protection. Infrastructure analysis shows the domain used Cloudflare’s DNS service, with the authoritative name servers denver.ns.cloudflare.com and elisabeth.ns.cloudflare.com.

The domain is currently listed as offline, and the phishing‑filtering service PhishDestroy has already blocked it. VirusTotal scans reported that three of ninety‑three security vendors flagged the domain, and it appears on a single external blocklist, reinforcing the suspicion of malicious activity. The available evidence confirms the presence of a crypto scam infrastructure, but the specific payload, victim interaction flow, and any associated command‑and‑control endpoints remain unknown because the site is no longer reachable. Defenders should continue to deny any network traffic to 188.114.97.3, enforce DNS sinkholing for the two Cloudflare name servers, and add amlchecken.com to internal blocklists.

Monitoring for re‑registration or reuse of the same IP address is advisable, as threat actors often relocate to similar Cloudflare‑fronted hosts. Because the site lacked SSL, any attempted connections would have been in clear text, providing an additional detection vector for network‑based security controls. In summary, the domain’s registration details, hosting profile, page title, and vendor detections collectively indicate a high‑confidence crypto scam that is presently offline but should be treated as hostile until further verification.