aml[.]check-my-crypto[.]com

Analysis of aml.check-my-crypto.com shows a newly registered domain (created 21 February 2026) that was used to host an investment‑style scam purporting to relate to Telegram. The HTTP response returned status code 200 and a page title of “Check my crypto,” indicating a probable lure for cryptocurrency investors. The domain resolves to IP address 84.200.87.140, which is assigned to Ultahost, Inc. in Germany (AS214036). The hosting infrastructure is served by four custom name servers (ns1crv.name.com, ns2qvz.name.com, ns3ckl.name.com, ns4lrt.name.com), a pattern often observed in short‑lived malicious sites.

The SSL certificate is identified as R12, a low‑trust issuance commonly associated with abuse. Reputation services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100, reinforcing the malicious classification. VirusTotal analysis recorded a single positive detection out of 93 scanning engines, and the domain is listed on at least one public security blocklist. The site has been taken offline but remains flagged by PhishDestroy.

The combination of brand impersonation of Telegram, investment‑scam narrative, low reputation metrics, and rapid domain turnover suggests a deliberate attempt to harvest credentials or funds from users seeking cryptocurrency services. Uncertainty remains regarding the exact phishing kit or payload delivered, as no additional content analysis is available. Defenders should block the domain and its associated IP at perimeter and DNS layers, add the observed name servers to watch lists, and monitor for new domains registered by the same registrar that use similar naming patterns or target the Telegram brand. Continuous threat‑intel feeds should be consulted for any resurgence of the hosting IP or reuse of the SSL profile.