amlbotsaveru[.]com

The domain amlbotsaveru.com was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline. DNS resolution points to the IPv4 address 193.58.121.240, which is allocated to AS215439 PLAY2GO INTERNATIONAL LIMITED and geolocated to Germany. The authoritative nameservers are dns1.regway.com, dns2.regway.com, dns3.regway.com, and dns4.regway.com. No SSL certificate is presented for the site, indicating that traffic would be unencrypted if the domain were active.

The page title retrieved during earlier scans reads "AMLBot - The full-fledged crypto compliance solution," matching the declared brand target AMLBot and confirming the campaign’s intent to impersonate the legitimate compliance service. VirusTotal analysis recorded detections from 2 of 93 security vendors, suggesting that at least some scanning engines recognize malicious characteristics. The domain is listed on two public blocklists, PhishDestroy and ScamSniffer, both of which classify it as an investment‑type scam.

The limited detection count and blocklist presence provide concrete evidence of malicious intent, but the absence of broader vendor consensus leaves uncertainty regarding the specific payload or credential‑harvesting mechanisms employed. Defenders should continue to block the domain at perimeter filters, monitor the hosting IP for any resurgence, and update threat‑intel feeds with the observed nameserver and registrar details. Additional investigation of the host ASN may reveal related infrastructure, and continued scanning of the IP address is advised to detect any re‑deployment of phishing content.