amlbot[.]uno

Analysis of the domain amlbot.uno indicates an active brand impersonation campaign targeting AMLBot, a crypto compliance service. The domain was registered on February 21, 2026, through Go Daddy, LLC, and remains operational as of July 23, 2026, resolving to the IP address 77.105.139.98. This IP is hosted in the Netherlands under AS216071 (SERVERS TECH FZCO), a network segment previously associated with fraudulent activity. The domain's SSL certificate is issued by Let's Encrypt (R11), a common choice for both legitimate and malicious sites due to its accessibility. The page title, 'AML Check - The full-fledged crypto compliance solution,' directly mirrors AMLBot's branding, suggesting an intent to deceive users seeking legitimate anti-money laundering tools for cryptocurrency transactions.

Detection data is limited but notable: the domain appears on one security blocklist (PhishDestroy) and is flagged by a single vendor on VirusTotal, though the specific detection context remains unverified. The HTTP status code 200 confirms the site is accessible, increasing the risk of exposure to potential victims. Nameservers ns17.domaincontrol.com and ns18.domaincontrol.com are consistent with Go Daddy's infrastructure, though this alone does not distinguish malicious from benign registrations. The scam type is classified as an investment scam, likely leveraging AMLBot's reputation to lure users into fraudulent compliance or financial schemes.

Defenders should prioritize blocking the domain and its resolving IP at the network level. Organizations using AMLBot services are advised to monitor for unauthorized access attempts or phishing reports linked to this domain. Further investigation into the hosting provider and associated infrastructure may reveal additional connected campaigns. Given the domain's recent registration and active status, continued monitoring for new detections or blocklist additions is recommended.