multiscan[.]app

PhishDestroy identifies multiscan.app as a confirmed brand impersonation threat specifically targeting AMLBot, a comprehensive AML compliance solution for crypto. The domain is currently offline, but its previous activity posed a significant risk to users seeking AMLBot services. The site was designed to deceive visitors into believing they were accessing legitimate AMLBot resources, potentially leading to credential theft or malware installation.

Technical analysis reveals several red flags. The domain was created on February 21, 2026, and registered through Squarespace Domains II LLC. It resolved to IP address 108.61.166.34 and was flagged by 7 out of 95 VirusTotal security vendors, indicating malicious consensus. The SSL certificate used was R12, which is not commonly associated with legitimate high-security services. It appeared on one security blocklist and was also found in an AlienVault OTX threat intelligence pulse, suggesting it was part of a broader phishing campaign. Despite these indicators, the site's page title—"AMLBot - Comprehensive AML Compliance Solutions for Crypto"—appeared convincing to the untrained eye.

Although multiscan.app has been taken offline, users should remain vigilant. Anyone who interacted with this domain should scan their devices for malware and monitor accounts for suspicious activity. PhishDestroy advises avoiding any unsolicited links and verifying URLs directly with the official AMLBot website. For future protection, enable multi-factor authentication and use threat intelligence feeds to block known malicious domains. Staying informed through reputable security sources is crucial in combating such brand impersonation threats.