crypto-aml[.]org

Analysis of crypto-aml.org indicates that the domain was registered through Web Commerce Communications Limited on 13 October 2025 and is hosted on a server in the Netherlands owned by RouterHosting LLC (ASN 14956) with IP 107.189.18.188. The authoritative nameservers are lia.ns.cloudflare.com and otto.ns.cloudflare.com, both operated by Cloudflare. The site presented the page title “AML Check” and was classified as a crypto scam that impersonates the CS:GO brand. No TLS certificate was observed, meaning the site was served over HTTP only.

The domain is currently taken offline, but it was listed on four security blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—indicating that multiple threat‑intelligence feeds have flagged it as malicious. VirusTotal scans from 95 vendors returned no detections, but the absence of detections does not constitute a safety guarantee. The lack of SSL, the short lifespan of the domain, and its appearance on multiple blocklists suggest a deliberate, short‑term campaign targeting users searching for anti‑money‑laundering or cryptocurrency verification services, leveraging the CS:GO name to increase credibility. Uncertainty remains regarding the exact content that was delivered to victims, the presence of any credential‑harvesting forms, or the use of additional infrastructure such as command‑and‑control servers.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same host or IP address, and add the associated IP and nameserver pairs to internal allow‑list exclusions only after thorough verification. Threat‑intel teams should correlate any observed traffic to the domain with existing CS:GO‑related phishing campaigns and consider sharing indicators of compromise with industry‑wide sharing platforms. Ongoing vigilance is advised, as actors may re‑register similar namespaces or shift to alternative hosting providers.