amltronscan[.]xyz

This domain, amltronscan.xyz, is identified as a generic phishing site targeting cryptocurrency users under the guise of an AML compliance tool branded as AMLBot. The page title explicitly presents itself as an 'Aml crypto checker - blockchain analysis tool AMLBot,' suggesting an attempt to deceive users into believing it offers legitimate anti-money laundering verification services for blockchain transactions. No specific drainer kit signatures have been conclusively linked to this domain at the time of analysis, though its branding alignment with established crypto compliance services indicates a likely credential harvesting or wallet-draining objective. Infrastructure analysis reveals the domain was registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 172.67.199.176. Security vendor detections on VirusTotal report 5 out of 95 engines flagging the domain as malicious, while it appears on two independent security blocklists. The SSL certificate is issued by Google Trust Services, providing an illusion of legitimacy despite the domain's fraudulent intent. No detections were recorded in Google Safe Browsing at the time of assessment, though it is actively blocked by at least two specialized anti-phishing tools. The domain has since been taken offline, reducing immediate exposure risk to end users. However, historical DNS records and cached content may still pose residual threats if accessed through unpatched or misconfigured systems. Users who previously interacted with the domain are advised to revoke any connected wallet permissions, rotate credentials, and monitor transaction histories for unauthorized activity. Continued vigilance is recommended, as threat actors frequently re-deploy phishing infrastructure under similar or newly registered domains to evade detection.