amibot[.]org

Amibot.org is currently active and has been classified as a generic phishing infrastructure. The domain was registered on 7 March 2026 through CNOBIN INFORMATION TECHNOLOGY LIMITED and resolves to the IPv4 address 158.94.211.169. Authoritative name resolution is provided by the DNSPod nameservers a.dnspod.com, b.dnspod.com and c.dnspod.com. The domain’s age and the use of a commercial registrar are consistent with recent malicious deployments observed in the region. VirusTotal records indicate that the host was submitted to 91 scanning engines, none of which reported a detection at the time of analysis; the absence of detections does not imply benign intent and should be interpreted cautiously. No public content or page metadata has been disclosed, leaving the specific phishing payload or targeted brand undefined. Consequently, the confidence in the phishing classification derives primarily from the threat intelligence tag and the observed infrastructure characteristics. Defenders should block network traffic to 158.94.211.169, add amibot.org to domain blocklists, and monitor DNS queries for the associated DNSPod name servers. Continuous re‑evaluation is advised as additional evidence, such as payload samples or victim reports, becomes available.