amlbot[.]bio

This domain, amlbot.bio, is actively hosting an infrastructure that mimics the AMLBot brand. DNS resolution points to 172.67.216.190, a Cloudflare edge node located in Canada, and the authoritative nameservers are skip.ns.cloudflare.com and laura.ns.cloudflare.com. The site presents a valid TLS certificate issued by Let’s Encrypt (entity YE1) and was registered through Nicnames, Inc. Automated analysis shows the page title “refactor” but no further content has been publicly disclosed. The domain is listed on two security blocklists, PhishDestroy and ScamSniffer, and VirusTotal reports three detections out of ninety‑one scanned vendors, indicating malicious activity. The observed scam type is classified as an investment scam, and the threat is identified as brand impersonation of AMLBot. Infrastructure evidence suggests the operators are leveraging Cloudflare’s CDN to obscure origin, a common tactic for fast‑flux‑like campaigns. While the exact payload or phishing page has not been captured, the combination of brand targeting, blocklist presence, and multiple vendor flags warrants immediate remediation. Defenders should block amlbot.bio at DNS and proxy layers, monitor for related CNAME or IP reuse, and consider sinkholing the Cloudflare IP range if feasible. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this domain.