trust-amlcheck[.]com

Analysis of www.trust-amlcheck.com shows a domain created on February 21, 2026 and registered through Ultahost, Inc. The authoritative nameservers are ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, and ns4.ultahost.com, all pointing to the same hosting provider. The domain resolves to IP address 15.197.129.158, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated to the United States. No TLS certificate is presented, indicating that the site operates without encryption. The page title returned from the site is "AML Verification - AMLBot," and the threat classification in the intelligence feed labels the activity as a Crypto Scam.

The domain has been taken offline and is currently listed as blocked by the PhishDestroy blocklist, appearing on one security blocklist overall. VirusTotal records show that the domain was scanned by 93 vendors, with none reporting a detection at the time of the scan. While the lack of detections does not constitute confirmation of safety, it does indicate that no known malware signatures were observed. Defenders should treat the domain as a high‑confidence indicator of a crypto‑related phishing operation.

Recommended actions include adding the domain and its IP address to existing deny‑lists, monitoring the IP range for any future re‑use, and continuing to query threat‑intelligence feeds for any resurgence. Because the site is offline, real‑time probing is not possible; however, repeated DNS resolution attempts should be logged to detect any re‑activation. Continuous observation of the associated ASN (AS16509) for new malicious domains is advisable, as the infrastructure may be leveraged for other campaigns. In summary, the available evidence points to a deliberately crafted phishing page targeting anti‑money‑laundering verification processes, and defensive teams should proactively block and monitor the associated infrastructure.