amlbotai[.]io

The domain amlbotai.io was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on 29 December 2025. DNS resolution points to the Cloudflare address 104.21.83.149, hosted under ASN 13335 (Cloudflare, Inc.) with the domain’s authoritative nameservers listed as rene.ns.cloudflare.com and sneh.ns.cloudflare.com. No TLS certificate was observed, indicating that HTTPS connections are unavailable. The HTTP response returns a page whose title is “AML Bot”, and the site explicitly claims to represent the AMLBot brand, which aligns with the recorded brand‑impersonation indicator. The activity has been classified as a crypto‑scam, although the exact payload or monetary mechanism has not been captured in the available evidence.

VirusTotal analysis shows that six of ninety‑three scanning engines flag the domain as malicious, confirming a moderate level of detection across independent scanners. The domain is currently listed on one public blocklist and is actively blocked by the PhishDestroy filtering service. Gridinsoft assigns a trust score of zero out of one hundred, and AlienVault OTX references the domain in a single threat‑intel pulse, reinforcing its malicious reputation. As of the report date (24 July 2026) the site is reported offline, and no SSL certificate or active content is available for further inspection. Consequently, the precise phishing landing page, credential‑capture forms, or malicious scripts cannot be described.

Defenders should continue to deny any network traffic to amlbotai.io, add the domain to internal deny‑list policies, and monitor for any resurgence of the domain or related sub‑domains. Given the Cloudflare hosting, threat actors could quickly re‑activate the domain or spin up new pointers, so periodic DNS‑resolution checks are advised. Correlation with the known brand AMLBot should trigger heightened scrutiny of any outbound communications that reference AMLBot services, especially those involving cryptocurrency transactions.