aml-check[.]ws

The domain aml-check.ws is a phishing site involved in brand impersonation targeting the AML Scam brand. It was used to deceive visitors by mimicking a legitimate anti-money laundering compliance platform but is currently taken offline. This domain posed an elevated risk due to its association with cryptocurrency scams despite lacking a known drainer kit.

Technical indicators for aml-check.ws include detection by 1 of 95 VirusTotal security vendors, specifically flagged by SOCRadar. The domain was registered through Key-Systems GmbH on September 16, 2025, and resolves to the IP address 46.28.69.52 located in Germany under AS21100 GREEN FLOID LLC. It appears on one security blocklist, PhishDestroy. No SSL certificate was issued for the site, and the page title observed was 'AMLGuard - Advanced Anti-Money Laundering Compliance Platform'. The domain uses multiple nameservers including nsa1.srv53.org and others.

To stay safe from phishing scams like aml-check.ws, users should avoid interacting with suspicious sites and monitor their cryptocurrency wallets closely. If credentials were entered, it is advised to change passwords immediately and enable two-factor authentication where possible. For cryptocurrency-related threats, revoking token approvals and transferring funds to secure wallets is recommended. Suspicious activity or incidents related to aml-check.ws should be reported to relevant security organizations and blocklist providers such as PhishDestroy to aid in mitigation efforts.