myamlcheck[.]pro

Analysis of the domain myamlcheck.pro, observed on July 24, 2026, shows a short‑lived infrastructure that aligns with a crypto‑related scam targeting the CS:GO community. The domain was registered on October 29, 2025 through Web Commerce Communications Limited and currently lacks an SSL certificate, indicating the site was served over plain HTTP. Its page title, "AML Check," does not reference the impersonated brand, yet the intelligence indicates the site explicitly impersonates CS:GO, a common tactic for crypto‑draining campaigns. The domain resolves to the IP address 81.28.12.12, which is hosted in the United States under Autonomous System AS199524 belonging to G‑Core Labs S.A.; the same IP is associated with the nameservers ns1.gcorelabs.net and ns2.gcdn.services.

Reputation scoring from Gridinsoft assigns a zero‑out‑of‑one‑hundred trust rating, reinforcing the malicious nature of the host. VirusTotal analysis recorded detections from two of ninety‑five security vendors, and the domain appears on two external blocklists, including PhishDestroy and ScamSniffer, both of which have actively blocked the site. The overall risk assessment is elevated, and the infrastructure has been taken offline, as indicated by the current status flag.

Defenders should continue to block the domain and its associated IP address at network perimeters, monitor for any re‑registration attempts, and consider adding the nameservers to watchlists for future activity. Because no SSL certificate is present and the site is offline, further content inspection is not possible, leaving the exact phishing payload unknown. Continuous observation of the hosting provider and the ASN is recommended to detect any related campaigns that may reuse the same infrastructure.