amlbot-check[.]promo

Analysis of the domain amlbot-check.promo shows a clear pattern of brand impersonation targeting the AMLBot service. The domain resolves to the IP address 104.21.20.241, which is owned by Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The authoritative nameservers are dax.ns.cloudflare.com and paris.ns.cloudflare.com, both belonging to the same provider, indicating that the attacker leveraged Cloudflare’s DNS infrastructure to hide the true origin of the site. The HTTP response returned a page title of “AMLBot”, matching the advertised brand, while the site presented no SSL/TLS certificate, leaving the connection unencrypted and exposing any credentials entered by a victim.

Gridinsoft’s trust scoring system assigned a score of 0 out of 100, reflecting an extremely low reputation. The domain is cataloged as a crypto‑related scam, and one of ninety‑five VirusTotal scanners flagged it as malicious, confirming that at least one security vendor recognized the threat. It appears on a single security blocklist and has been actively blocked by the PhishDestroy service, which has taken the domain offline as of the report date. The registration was performed through Cloudflare, Inc., further obscuring the registrant’s identity.

While the available data confirms the domain’s malicious intent, details such as the specific phishing kit, payload delivery method, or victim interaction flow remain unknown because the site is no longer reachable. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicator, and monitor for any new sub‑domains or similar patterns that reuse the same Cloudflare IP range or nameserver configuration. Threat intelligence teams should also share the indicator with industry sharing platforms to improve collective detection of this brand‑impersonation campaign.