amlformcheck[.]click

This domain, amlformcheck.click, is identified as a high-risk brand impersonation threat specifically targeting users of anti-money laundering (AML) compliance platforms. Analysis indicates the domain masquerades as legitimate AML verification tools, presenting itself under the page title 'Unlock Finance Success with AMLTestWallet & AMLCheck 2!'. The infrastructure is designed to deceive users into interacting with fraudulent financial compliance interfaces, likely deploying wallet-draining scripts upon connection. No explicit drainer kit signature was recovered from passive scans, but the presence of SweetAlert2 and Vue.js frameworks suggests dynamic interaction capabilities consistent with crypto asset theft operations. Infrastructure analysis reveals the domain was registered through Global Domain Group LLC on May 7, 2026, an anomalous future date indicative of registrar data manipulation or typographical error. The domain resolves to IP address 172.67.160.230, a Cloudflare-protected endpoint commonly exploited to obfuscate malicious infrastructure. Detection metrics show 14 of 95 security vendors flagging the domain on VirusTotal, while it appears on three distinct security blocklists. Technologies detected include Node.js, Nuxt.js, and Cloudflare Browser Insights, with HTTP/3 protocol support enhancing evasion potential. Gridinsoft trust score is 0/100, corroborating the malicious classification. Current status indicates the domain has been taken offline, likely in response to detection and blocklisting by MetaMask, PhishDestroy, and SEAL. While the immediate threat is mitigated, the registration infrastructure and hosting patterns remain active, posing residual risk. Users who interacted with the domain prior to takedown should immediately revoke connected wallet permissions, rotate credentials for associated financial accounts, and monitor transaction histories for unauthorized asset transfers. Organizations operating AML compliance platforms are advised to implement proactive domain monitoring for similar impersonation patterns and educate users on verifying official communication channels.