amlcheck[.]group

The domain amlcheck.group is a phishing site engaged in brand impersonation, specifically targeting the csgo brand, and is classified as a cryptocurrency scam. It was taken offline after being identified as a threat, with no drainer kit detected. The site posed as 'AML Bot' to deceive users, presenting a high risk for those seeking to verify transactions or interact with csgo-related services, making it unsafe for use.

Technical analysis reveals that amlcheck.group was flagged by 1 of 95 VirusTotal vendors, including alphaMountain.ai, and appeared on 1 security blocklist, PhishDestroy. It was registered through Cloudflare, Inc., and resolved to IP address 172.67.221.10, located in the US under AS13335 Cloudflare, Inc. The site had no SSL certificate, and its nameservers were gemma.ns.cloudflare.com and sean.ns.cloudflare.com. The HTTP status returned was 429, and the Gridinsoft trust score was 0/100. Google Safe Browsing did not flag the domain.

To protect against this phishing threat, users should avoid visiting amlcheck.group and ensure their devices are scanned for malware. Since the site impersonated csgo and involved cryptocurrency, victims who may have interacted with it should revoke any token approvals and move funds to a new wallet. Reporting the domain to authorities like the Anti-Phishing Working Group or local cybercrime units is recommended. For general safety, change passwords for any accounts potentially compromised, enable two-factor authentication, and monitor for suspicious activity.