checkaml[.]my

On 24 July 2026 the domain checkaml.my was observed as part of a brand‑impersonation campaign targeting the AMLBot service. The domain was registered on 3 March 2026 through Hostinger operations, UAB and is delegated to the generic parking nameservers ns1.dns‑parking.com and ns2.dns‑parking.com. DNS resolution points to the IPv4 address 82.29.186.223, which belongs to AS47583 (Hostinger International Limited) and is geolocated in the United Kingdom. No TLS certificate is presented for the host, indicating that HTTPS connections are not supported.

The HTTP response, when the site was live, returned a page whose title was “AML Bot”, matching the declared impersonated brand. The site was classified as a crypto‑scam and is currently listed as offline. Independent blocklist services PhishDestroy and ScamSniffer have added the domain to their respective blocklists, and it appears on two additional security blocklists. VirusTotal recorded a single positive detection out of 93 scanning engines, confirming that at least one vendor identified malicious behavior.

The limited detection footprint, combined with the absence of SSL and the use of parking nameservers, suggests a low‑cost infrastructure typical of opportunistic impersonation campaigns. However, the exact payload, phishing kit, or victim interaction flow has not been publicly disclosed, leaving the full attack vector uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host, and apply brand‑specific threat intelligence to detect similar impersonation attempts. Ongoing observation of the associated IP address and registrar activity is recommended to identify potential re‑use of the same hosting resources.