aml-bots[.]world

This domain, aml-bots.world, poses a brand impersonation threat targeting AMLBot, a cryptocurrency compliance service. Attackers use such domains to deceive users into entering credentials, financial details, or installing malicious software under the guise of a legitimate service. The site displays a placeholder page with the title 'しばらくお待ちください...' (Please wait...), a common tactic to mask malicious intent while preparing for active exploitation. Users may encounter this domain through phishing emails, fake advertisements, or compromised third-party sites redirecting to it.

Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with high-risk registrations. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, confirming its involvement in phishing or fraudulent activities. The domain resolves to the IP address 188.114.96.3 and appears on three security blocklists, including MetaMask and SEAL. Gridinsoft assigned a trust score of 0/100, further validating its malicious classification. Infrastructure analysis reveals the domain is currently offline, though this status may change.

If you visited aml-bots.world, take immediate action to mitigate potential risks. Disconnect the device from the network to prevent further data exfiltration. Run a full scan using updated antivirus or endpoint detection tools to identify and remove any malware. Reset credentials for any accounts accessed while the domain was open, especially those related to cryptocurrency or financial services. Monitor accounts for unauthorized transactions and enable multi-factor authentication where possible. Report the incident to your organization’s security team or a trusted cybersecurity provider for further analysis.