amlbot-eu[.]ink

The domain amlbot-eu.ink is currently active and has been identified as an investment‑type brand impersonation targeting the AMLBot brand. Infrastructure analysis shows the domain resolves to IP address 46.29.26.12, which is geolocated to Turkey and associated with FortiCore Digital. The site presents a valid HTTPS certificate issued by Let’s Encrypt (identifier YE1) and returns HTTP 200, indicating a live web server. Registration details list NameSilo, LLC as the registrar, and the authoritative nameservers are teresa.ns.cloudflare.com and braden.ns.cloudflare.com. Threat intelligence sources have placed the domain on two security blocklists, and it is flagged by PhishDestroy and ScamSniffer. VirusTotal scans report that seven of ninety‑one security vendors flag the domain as malicious, reinforcing the suspicion. The page title "AMLBot-AE: Secure DeFi Transactions With AMLBot Protection" explicitly references the targeted brand, confirming the impersonation intent. While the exact content of the landing page has not been publicly analyzed, the convergence of brand‑specific title, investment‑scam classification, and multiple security detections suggests a high‑risk profile. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP and nameservers, and add the domain to internal blocklists. Continued observation is advised to capture any evolving payloads or credential‑harvesting activity.