freeaml-bot[.]com

PhishDestroy identifies freeaml-bot.com as an active crypto drainer posing as a free AML bot service. This domain is engineered to trick users into connecting cryptocurrency wallets, then silently siphon tokens via malicious smart-contract interactions. The campaign is hosted on infrastructure controlled by threat actors and leverages a recently registered domain to appear legitimate while evading early detection. This domain was flagged by PhishDestroy on March 30, 2026, the same day it was registered with CNOBIN INFORMATION TECHNOLOGY LIMITED. It resolves to IP 172.67.179.8 and holds a valid Let’s Encrypt SSL certificate to enhance credibility. VirusTotal currently shows 0 detections out of 95 engines, indicating it is not yet widely blacklisted. At the time of analysis, the domain remains unlisted on major blocklists, allowing it to continue operating undetected. Users who visited freeaml-bot.com should immediately revoke any connected wallet permissions using tools like revoke.cash or your wallet’s dApp browser. Do not interact with any prompts or wallet connection requests on this site. Report the domain to PhishDestroy and your antivirus provider. If you entered private keys or signed transactions, monitor your wallet for unauthorized transfers and consider transferring remaining assets to a clean wallet. Always verify URLs and use official sources before connecting wallets to crypto services.