amlwallet[.]co

On 23 July 2026, analysis of the domain amlwallet.co was performed. The zone was registered on 21 February 2026 and, as of the assessment date, the site is taken offline. DNS resolution points to the IP address 104.21.14.97, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The TLS certificate presented for the host is identified as “WE1”, indicating a generic or self‑issued certificate. The page title returned by the server is “AML Bot”, which aligns with the reported brand target AMLBot.

VirusTotal scans show that seven out of ninety‑three security vendors flagged the domain as malicious, confirming a consensus of suspicion among automated scanners. The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy service. Additional reputation data include a Gridinsoft trust score of zero out of one hundred, reinforcing the classification of the site as untrusted. The observed indicators collectively point to a crypto‑focused scam that leverages brand impersonation of AMLBot, a known service in the cryptocurrency space.

While the site is currently offline, the infrastructure—particularly the use of a Cloudflare edge node—suggests that the operators could reactivate the domain or duplicate the pattern on new domains. Defenders should add the domain and its associated IP address to blocklists, monitor for re‑appearance in DNS queries, and correlate any future traffic against the “WE1” certificate fingerprint. Organizations handling AMLBot‑related assets should educate users about the risk of unsolicited communications referencing AMLBot and enforce strict validation of URLs before any credential entry. Continued observation of the IP range and Cloudflare‑associated domains is recommended to detect potential re‑use of the same hosting profile.