amlcheck[.]sbs

The domain amlcheck.sbs was registered on March 22, 2026 through Global Domain Group LLC and is currently taken offline. Technical analysis shows the site was served via Cloudflare, using nameservers sarah.ns.cloudflare.com and tanner.ns.cloudflare.com, and resolved to the IP address 188.114.97.3, which is associated with Cloudflare, Inc. in Canada. No SSL certificate was observed, indicating the site operated without HTTPS encryption. The page title returned by the server was "AML Check," and the page employed third‑party delivery services such as Unpkg, jsDelivr, and Cloudflare Browser Insights, with traffic delivered over HTTP/3.

VirusTotal records indicate that six out of ninety‑four security vendors flagged the domain as malicious, and the domain appears on a single public blocklist, where it is actively blocked by PhishDestroy. The known scam type is a crypto‑related scheme, consistent with the "Crypto Scam" label in the intelligence. While the site is no longer reachable, the combination of a recent registration date, lack of TLS, reliance on script‑hosting CDNs, and multiple vendor detections suggests a high likelihood that the domain was used for fraudulent activity targeting cryptocurrency users.

Uncertainty remains regarding the exact payload or victim interaction, as no detailed page content or phishing kit information is available. Defenders should continue to block the domain at the network perimeter, add the IP address 188.114.97.3 to deny‑list rules where appropriate, and monitor DNS queries for any resurgence of the domain or related subdomains. Ongoing threat‑intel feeds should be consulted for any new detections, and any internal logs that reference the domain should be examined for potential compromise attempts.