amlcheckton[.]com

Analysis of amlcheckton.com, created on 28 March 2025 and currently taken offline, shows that it is part of an elevated‑risk generic phishing operation that targets cryptocurrency users. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and uses Cloudflare nameservers ingrid.ns.cloudflare.com and rodrigo.ns.cloudflare.com. DNS resolution points to IP address 104.21.96.1, which belongs to Cloudflare’s AS13335 network and is geolocated in the United States. The hosting infrastructure advertises Cloudflare services and HTTP/3 support, and the TLS certificate is issued by SSL Corporation via the Cloudflare TLS Issuing ECC CA 3, confirming the use of Cloudflare’s edge security layer. VirusTotal scans have returned 15 positive detections out of 93 security vendors, indicating that multiple anti‑malware engines consider the domain malicious.

AlienVault OTX records the domain in one threat‑intelligence pulse, and the site appears on two public blocklists. Independent phishing‑filtering services PhishDestroy and ScamSniffer have already added the domain to their block lists. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The listed scam type is “Crypto Scam,” suggesting that the payload or lure likely involves illicit cryptocurrency requests, wallet address theft, or fraudulent investment schemes. No additional page‑title information is available, and the site’s content has not been publicly captured because the domain is offline.

The combination of registrar data, Cloudflare‑based hosting, low trust score, multiple vendor detections, and inclusion on specialized blocklists provides concrete evidence that the domain should be treated as hostile. Defenders should ensure that outbound traffic to 104.21.96.1 is denied or monitored, add amlcheckton.com to DNS‑based blacklists, and include the domain in any URL filtering policies aimed at cryptocurrency‑related threats.