toncryptoamlchecker[.]com

The domain toncryptoamlchecker.com was registered on Feb 21 2026 through PDR Ltd d/b/a PublicDomainRegistry.com. It resolves to 172.67.156.115, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain is currently active and returns HTTP 200 responses. The page title observed is “toncryptoamlchecker.com | 521: Web server is down”, suggesting a misconfiguration or a deliberately presented error page.

Infrastructure analysis shows the site is fronted by Cloudflare and supports HTTP/3. Authoritative nameservers are chris.ns.cloudflare.com and saanvi.ns.cloudflare.com. TLS termination is performed by Google Trust Services under the WE1 certificate profile, delivering a valid certificate chain. The combination of a 200 HTTP status with a 521 page title indicates that the CDN is serving traffic while the underlying origin may be unreachable.

Threat intelligence classifies the site as a brand‑impersonation campaign targeting AML Scam victims using a cryptocurrency lure. The Gridinsoft trust score is 0/100, three of ninety‑five VirusTotal scanners flag the domain, and it appears on four blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. These indicators together assign a high‑risk rating to the domain.

Defenders should block or sinkhole the domain name and its resolved IP address, add the associated Cloudflare nameservers to monitoring rules, and enable TLS inspection to detect any malicious payloads that might be delivered behind the CDN. Continuous monitoring of DNS resolution for changes and correlation with alerts from the listed blocklists will help detect infrastructure shifts. User education about the AML Scam impersonation technique and caution against unsolicited cryptocurrency verification requests referencing this domain are also recommended.