checker-aml[.]cc

This domain, checker-aml.cc, is a confirmed brand impersonation threat targeting users of a major cryptocurrency exchange platform. Analysis indicates the site falsely presents itself as a next-level DeFi security solution, specifically mimicking tools like AMLBot to deceive victims into disclosing sensitive account credentials, wallet keys, or executing fraudulent transactions. The page title, 'Discover Checker-AML & AMLBot: Next-Level DeFi Security,' directly exploits trust in legitimate security services, while the underlying infrastructure is designed to harvest authentication details under false pretenses. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on November 19, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious activity. It resolves to the IP address 188.114.96.3 and is protected by Cloudflare, which is commonly leveraged to obscure hosting origins. The domain appears on six security blocklists and is flagged by 12 out of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. Additionally, the domain has been included in three AlienVault OTX threat intelligence pulses, further corroborating its malicious classification. Users who visited checker-aml.cc should immediately revoke any session tokens or API keys associated with their exchange accounts. If credentials were entered, they must be changed from a secure device, and all linked devices should be scanned for malware. Wallet addresses or transaction details shared with the site should be considered compromised, and any pending transactions should be reviewed for unauthorized activity. Due to the high-risk nature of this domain, affected users are advised to enable multi-factor authentication and monitor account activity for anomalies. The domain has been taken offline, but similar threats may emerge using comparable infrastructure or branding.