amlscan[.]zip

amlscan.zip entered the PhishDestroy evidence set on Feb 10, 2026. The stored content classification is aml scam. The assembled evidence scores 63/100 (elevated).

Two independent sources are positive: VirusTotal and ScamSniffer. VirusTotal recorded 1 detections among 93 engines: Gridinsoft on Jul 18, 2026 at 14:45 UTC. ScamSniffer listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. The evidence is not unanimous. URLQuery recorded no positive detection on Feb 10, 2026 at 18:19 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:38 UTC. URLScan completed without a malicious verdict (score 0) on Mar 26, 2026 at 12:31 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:44 UTC; content was unavailable. Registration records for the domain list Tucows Domains Inc. as the registrar. At collection time, the hostname resolved to 138.124.67.249 on AS215540 (GCS-AS GLOBAL CONNECTIVITY SOLUTIONS LLP, GB). The associated network metadata labels the endpoint as AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP in Kerkrade, NL. The stored server header is nginx/1.28.1. Captured page title: “Crypto AML Check - Cryptocurrency Transaction Monitoring Solution | Sumsub”. DOM analysis completed on Jul 27, 2026 at 02:20 UTC; stored DOM score 0/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. IoC extraction completed on Jul 29, 2026 at 02:37 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Let's Encrypt / R12 as the certificate issuer with validity through Apr 21, 2026; checked Mar 15, 2026 at 05:51 UTC.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as aml scam.