checker-security[.]click

PhishDestroy has confirmed that checker-security.click is a verified phishing domain targeting Web3 users by impersonating the legitimate cryptocurrency compliance platforms AMLConnect and AMLBot. The site is now offline, but during its active period it posed a significant threat to users seeking to secure blockchain transactions. The domain was registered on April 01, 2026, through Global Domain Group LLC, and resolved to IP address 95.85.241.94. It carried an SSL certificate issued by Let's Encrypt (R13), which is commonly abused by malicious sites to appear legitimate. VirusTotal flagged the domain with 9 out of 95 security vendors, and it was listed on at least one security blocklist, indicating broad recognition of its malicious intent. The site's title, "AMLConnect and AMLBot: Securing Web3 Transactions Effectively," was designed to lure crypto users into believing they were accessing official services. Because the domain is now offline, immediate direct risk is reduced, but users should remain vigilant. PhishDestroy recommends that anyone who interacted with this site, especially those who entered credentials or connected wallets, immediately change their passwords, enable two-factor authentication, and monitor accounts for unauthorized activity. Always verify URLs by checking official sources before engaging with Web3 platforms, and report any similar suspicious domains to threat intelligence services.