amlbotservices[.]net

amlbotservices.net was registered on 29 October 2025 through Web Commerce Communications Limited and is hosted on Cloudflare’s network (ASN 13335, IPv6 address 2606:4700:3034::6815:145, located in the United States). The domain resolves to Cloudflare’s edge service and uses the Cloudflare name servers grant.ns.cloudflare.com and tess.ns.cloudflare.com. No TLS certificate is presented; attempts to establish HTTPS result in a connection error, indicating the site is not serving encrypted traffic. The only visible HTML element retrieved before the site was taken offline is the page title “AML Checker”, which aligns with the declared impersonation of the AMLBot brand.

Internal scans recorded three positive detections out of ninety‑five antivirus engines on VirusTotal, confirming that security products have identified malicious behavior associated with the domain. The domain is listed on a single blocklist and has been actively blocked by the PhishDestroy service. The reported scam type is “Crypto Scam”, suggesting that the site likely attempted to solicit cryptocurrency payments under the pretense of AML verification. Current status is offline, which limits further behavioural analysis.

Uncertainty remains regarding the exact payload delivered, command‑and‑control infrastructure, and whether the domain was used to host phishing forms or download malicious binaries. Defenders should continue to monitor the IPv6 address and associated Cloudflare edge nodes for any re‑use, enforce outbound filtering for the domain and related hostnames, and add the IPv6 address to intrusion‑prevention rules. In addition, organizations using AMLBot services should educate users about unsolicited requests for cryptocurrency and verify any AML‑related communications through official channels. Ongoing threat‑intel feeds should be consulted for potential redeployment of the infrastructure under new domains.