check[.]aml-kyt[.]icu

Analysis of the domain check.aml-kyt.icu shows a newly registered site (creation date August 01 2025) that was hosted on Cloudflare infrastructure and resolved to IP 172.67.169.238, an address attributed to AS13335 Cloudflare, Inc. in the United States. The domain is configured with Cloudflare nameservers (bob.ns.cloudflare.com, candy.ns.cloudflare.com) and was registered through Web Commerce Communications Limited. No TLS certificate was observed, indicating the site was served over plain HTTP, which is atypical for a service purporting to perform AML checks. The page title returned by the site – “Check AML Online – AML проверка онлайн” – suggests a focus on anti‑money‑laundering verification, yet the threat classification lists the activity as a crypto‑related scam.

Trust metrics are extremely low: Gridinsoft assigns a score of 0 / 100, while Scamadviser rates the domain at 1 / 100, both reflecting a high probability of malicious intent. VirusTotal scans recorded four detections out of ninety‑five security vendors, reinforcing the suspicion of abuse. The domain appears on a single external blocklist and has been actively blocked by PhishDestroy.

Current HTTP status is offline, but the combination of poor trust scores, lack of encryption, and vendor detections provides sufficient evidence for defenders to treat the indicator as hostile. Uncertainty remains regarding the exact payload or phishing lures used, as no page content beyond the title has been disclosed. Recommendations include immediate blocking of the domain and its associated IP, inclusion in internal threat‑intel feeds, monitoring of the DNS records for potential re‑use, and continued observation of related Cloudflare‑hosted infrastructure for similar patterns.