# amlbot.ws — SUSPICIOUS

> amlbot.ws is a confirmed phishing domain detected by PhishDestroy. Multiple security vendors have flagged this domain. Our analysis includes WHOIS records, SSL data, and blocklist cross-referencing.

## Summary
Threat Overview
The domain amlbot.ws has been flagged as a phishing threat. PhishDestroy's automated scanning systems detected multiple risk indicators associated with this domain.
Detection Details
This domain was identified through a combination of automated analysis, community reports, and cross-referencing with global threat intelligence feeds including VirusTotal, Google Safe Browsing, and 50+ specialized blocklists.
Risk Indicators

- Domain registered on ws TLD
- Domain length: 9 characters
- Registered on a high-risk free TLD commonly used by phishers

Stay Safe
Always verify URLs before entering credentials. Use a password manager to avoid typing passwords on fake sites. Enable two-factor authentication wherever possible.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 502)
- Scam type: AML Scam
- Target brand: AMLBot
- Page title: Clock error

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: GoDaddy.com, LLC
- Country: US
- IP: 77.105.139.98
- IP Country: NL
- IP City: Amsterdam
- IP Org: AS216071 SERVERS TECH FZCO
- Nameservers: ["ns45.domaincontrol.com", "ns46.domaincontrol.com"]
- SSL Issuer: Let's Encrypt / R11

## Detection Status
- VirusTotal: 0 vendors flagged
  Vendors: []
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "ScamSniffer", "Enkrypt"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/0197f3e7-2a21-7498-93af-f9398f617965.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/0b493ff3-2b53-4d75-b51e-d877d7ae7203
- PhishDestroy: https://phishdestroy.io/domain/amlbot.ws/
- LLM endpoint: https://phishdestroy.io/domain/amlbot.ws/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/amlbot.ws/
Last updated: 2026-03-19