Cerca i domini monitorati ed esamina le prove archiviate, i rilevamenti e gli ultimi dati relativi alla disponibilità osservata.
193,644
Totale monitorato
193,644
VT rilevato
85,800
Ultima visualizzazione: attivo
99,033
Non disponibile all'ultimo controllo
0
VT In attesa di conferma
How This Attack Works
The scam exploits growing awareness of AML/KYC compliance requirements in crypto. Users who want to verify their funds are "clean" land on a convincing clone and unknowingly authorize a wallet drainer.
STEP 1
Lure via Search & Social
Victims encounter fake AML check sites through Google Ads, Telegram DMs, social media posts, or SEO-poisoned search results for queries like "check wallet AML" or "is my crypto clean."
STEP 2
Clone Legitimate UI
The site closely mimics the official AMLBot.com design, branding, and interface. Some clones replicate staff profiles and create fake Telegram accounts impersonating AMLBot team members.
STEP 3
Request Wallet Connection
Unlike the real AMLBot (which only needs a wallet address as text input), the fake site asks users to "connect wallet" via MetaMask or WalletConnect to "generate an AML report."
STEP 4
Drain Assets via Smart Contract
The wallet connection triggers a malicious smart contract (setApprovalForAll or token approval) that scans all tokens/NFTs, prioritizes highest-value assets, and drains everything to attacker-controlled wallets. Transactions are irreversible.
Technical Analysis
The AML scam ecosystem uses sophisticated infrastructure. Domini typically use .com, .org, .app TLDs registered through privacy-friendly registrars (NICENIC, WEBCC account for 163+ domains). Many use Cloudflare CDN for legitimacy.
The drainer mechanism is identical to other wallet-connect phishing: upon connection, the site calls setApprovalForAll() or increaseAllowance() on the victim's token contracts. The drainer scans all assets, estimates value, and prioritizes extraction of highest-value tokens first.
According to AMLBot's 2025 Crypto Crime Relazione, 65% of crypto incidents are driven by social engineering rather than technical exploits, with phishing ranking as the #2 attack type (18% of all incidents).
Key technical indicators: domains containing 'aml', 'amlbot', 'aml-check', 'aml-verify' in the URL; wallet connection prompts (the real AMLBot never requires this); recently registered domains; missing or fake SSL certificates.
The drainer mechanism is identical to other wallet-connect phishing: upon connection, the site calls setApprovalForAll() or increaseAllowance() on the victim's token contracts. The drainer scans all assets, estimates value, and prioritizes extraction of highest-value tokens first.
According to AMLBot's 2025 Crypto Crime Relazione, 65% of crypto incidents are driven by social engineering rather than technical exploits, with phishing ranking as the #2 attack type (18% of all incidents).
Key technical indicators: domains containing 'aml', 'amlbot', 'aml-check', 'aml-verify' in the URL; wallet connection prompts (the real AMLBot never requires this); recently registered domains; missing or fake SSL certificates.
Real Cases
AMLBot Clone Wave (2024-2026) (2024-2026)
1,350+ fake domains stolen
AMLBot officially warned about an alarming rise in scammers impersonating AMLBot on various platforms, including fake Telegram bots and clone websites.
amlcheckwallet.cc Drainer (2024)
Wallet drainer active stolen
Registered via Dynadot Inc, resolved to Cloudflare IP 104.21.25.10. Served a fake "AML wallet check" interface with wallet-connect drainer. PhishDestroy report.
PCRisk AML Warning (Jan 2026) (January 2026)
12+ documented domains stolen
PCRisk documented a new wave of fake AMLBot sites including amlbotchecks.com, aml-safety.app, amlrobotsaveru.com, amlpremium.top. FTC reports over 46,000 people lost $1 billion to crypto scams since 2021. PCRisk report.
amlbotchecking.com Campaign (2024)
Multiple victims stolen
Typosquat of AMLBot serving crypto drainer via fake compliance check UI. Documented by Malware Guide and PCRisk.
How to Detect
Site asks to "connect wallet" — the real AMLBot only needs a wallet ADDRESS as text input, never a wallet connection
Dominio contains "aml" variations: amlbot, aml-check, aml-verify, amlcrypto (verify against official amlbot.com)
Recently registered domain (check WHOIS — legitimate AML services have years of history)
Urgente messaging: "Your wallet may be flagged" or "Controlla compliance before funds are frozen"
Promoted via Telegram DMs, Google Ads, or unsolicited emails instead of organic search
How to Protect Yourself
1
Bookmark the official AMLBot at amlbot.com — never click links from ads, DMs, or emails
2
Remember: legitimate AML tools only need a wallet address (text), never a wallet connection or private keys
3
Controlla any AML domain on PhishDestroy before interacting with it
4
Use a separate "burner" wallet with minimal funds when testing any new DeFi/Web3 service
5
If you connected your wallet to a suspicious site: immediately transfer remaining funds to a NEW wallet and revoke approvals at revoke.cash
Frequently Asked Questions
Data sourced from PhishDestroy threat intelligence database — 2,026 domains tracked for this threat type
Fake AML Controlla Scam 2,026 domains
security-indexer--adamlee160686.replit.app
instagramlogin68.blogspot.com
instagramloginverify.blogspot.com
amlbot-wallet.com
amlscores.com
cnsqarrlognn.webflow.io
itrstcptllogin.webflow.io
karmanakamloggen.godaddysites.com
nxjohny-user-coinbaseaml-blurtrench.pages.dev
trust-aml.org
aml-botscanner.com
amldetectionservices.com
cleancoin.lol
instagramloginpassword.blogspot.com
metamask-extension-get.created.app
trust-wallet-aml.org
aml-pro.live
aml-riskscore.info
amlbot-web3.cc
amlwalletverify.com
bijouteriedulac.ch
blekfilogxn.webflow.io
bybitamlchecker.com
coinsecurityscan.com
complienceaml.help
ethercheck.app
exodus-webs-wellet-en.pages.dev
kkrakkennllogain.webflow.io
mitomask-wallety.webflow.io
scan-tether.info
twalletaudit.com
walletguard.info
am1bot.cfd
aml-confirm.com
aml-safeusd.com
amlamlaml.ru
amlbot.rest
amlservicebot.com
analytics-aml.com
auditex.app
checks-aml.org
claim-momentum.com
download.web-metamask.to
instagramlogin-eta.vercel.app
instagramlogin99.blogspot.com
kouiikoxulogin.webflow.io
kucoilnlogiin.webflow.io
kucoinlogin-web.webflow.io
kucoinlogingty.webflow.io
raydiumsol.com
secure-transaction.sbs
tetheraudit-bot.com
thesaferelemento.net
trezor-bridge-info.live
tron-chk.com
trustwalletaml.com
twalletaudit.com.invite-web3-copytrading.app
web-chrome-extension-coinbase.typedream.app
www.automatedkycservices.com
xz12312333.elysium-drainer.world
aml-botz.org
aml-checking.website
aml-ivory.vercel.app
aml-signal.com
aml-tap.com
aml-trust.app
aml-trust.info
aml-wallet.one
amlbinances.org
amlbotplus.com
amlchec.pro
amlchecked.net
amlclear.com
amlconfirm.site
amlinfo.one
amlproof.online
amlradar.info
amlsecure.org
amlultra.com
amlverifies.com
amlwallets.io
amlxbybit.org
blekfilogon.webflow.io
btc-955axort.com
checkscrypto.com
eth-crypto-exchange.com
finance.ski
fraud-check.help
Pipeline di risposta alle minacce
Come vengono verificati tutti i domini presenti in questo hub e come vengono neutralizzate le minacce confermate. Visualizzazione completa della pipeline →
Controlli relativi alle informazioni sulle minacce— ogni dominio viene analizzato e sottoposto a verifica incrociata rispetto a:
urlscan.ioScreenshot · DOM · HTTPVirusTotal90+ AV enginesGoogle Safe BrowsingTransparency RelazioneCloudflare RadarDNS · certs · categoriesAlienVault OTXThreat-intel pulsesWayback MachineHistorical evidenceabuse.ch ThreatFoxIOC correlationcrt.shCertificate TransparencyDNS Sicurezza FiltersQuad9 · AdGuard · CleanBrowsingWeb-ControllaFull surface scan
crt.shSincronizzazione globale dei fornitori— i rilevamenti confermati vengono trasmessi a 29 partner:
GoogleSafe BrowsingGoogleWeb Risk APIMicrosoftSmartScreenVirusTotalDetection feedCloudflareRadar / 1.1.1.1YandexSafe BrowsingURLScan.ioPublic scanESETWebGuardBitdefenderThreat exchangeNortonSafe WebSymantecRecensione del sitoAviraCloud detectionAvast / AVGWeb ShieldKasperskyOpenTIPDr.WebOnline scannerNetcraftRimozione APIPhishTankVerified voteAPWG eCXBulk feedPhishStatsOpen feedPhish.RelazioneHosting abuseSpamhausDBL feedPolySwarmMarketplaceCheckPhishBolster scanQutteraMalware scanURLquerySandboxCriminal IPAsset intelCRDFThreat CenterScamadviserTrust scoreMyWOTWeb of Trust