aml-checks[.]icu

PhishDestroy identifies aml-checks.icu as an active brand impersonation phishing domain targeting AML Scam users. This domain was registered on June 14, 2025, through Web Commerce Communications Ltd and resolves to IP 89.124.78.7. It holds a Let’s Encrypt SSL certificate, indicating an attempt to appear legitimate while distributing fraudulent content. Security vendor analysis via VirusTotal shows detection by 11 out of 95 engines, reflecting elevated risk and widespread suspicion. The domain’s recent creation and low trust scores across multiple platforms highlight its malicious intent, specifically aimed at deceiving users into disclosing sensitive authentication credentials under the guise of legitimate AML verification services. This domain poses an immediate threat through targeted impersonation of AML Scam services. Key technical indicators include a domain creation date of June 14, 2025, registration under Web Commerce Communications Ltd, and hosting on 89.124.78.7. The presence of a valid SSL certificate (issued by Let’s Encrypt) suggests an attempt to bypass browser warnings and build false trust. VirusTotal analysis confirms detection by 11/95 security vendors, while the domain’s short operational lifespan and lack of established reputation further indicate malicious activity. Additional blocklist participation and low trust metrics across threat intelligence platforms reinforce its classification as an elevated-risk phishing resource. To mitigate exposure to this threat, users should avoid accessing aml-checks.icu entirely. Organizations should block the domain at DNS and firewall levels using the IP 89.124.78.7 and domain name as indicators. Security teams are advised to inspect network logs for outbound connections to this IP and inspect internal endpoints for signs of credential submission to external domains. Employees should be educated on recognizing brand impersonation tactics, particularly those mimicking AML verification processes, and report any suspicious communications. Proactive monitoring for newly registered domains resembling legitimate AML platforms is recommended to prevent credential theft and financial fraud.