amlchecker[.]org

This domain, amlchecker.org, is flagged for brand impersonation targeting Telegram, specifically mimicking the AML Bot service. Analysis indicates the site was designed to deceive users into submitting sensitive credentials or financial information under the guise of a legitimate anti-money laundering verification tool. The threat type is classified as elevated due to the targeted nature of the impersonation and the potential for significant user data compromise. Infrastructure analysis reveals the domain was registered on January 23, 2025, through Name.com, Inc., and resolves to the IP address 151.245.195.32. It employs Google Cloud and Nginx for hosting, alongside Google Cloud CDN for content delivery, secured with a Google Trust Services SSL certificate. Detection metrics show 4 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The domain has a Gridinsoft trust score of 0/100, further confirming its high-risk status. As of the latest assessment, amlchecker.org has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations are advised to monitor for unauthorized access attempts linked to credentials potentially harvested by this phishing campaign. Network defenders should update blocklists to include the domain and associated IP, while users should verify the authenticity of any AML-related services through official Telegram channels only.