arnlguard[.]com

arnlguard.com was registered on 21 February 2026 and resolves to the Cloudflare IP 172.67.152.30, advertised as belonging to AS13335 Cloudflare, Inc. in the United States. The site presents the page title “AML Bot”, indicating an attempt to impersonate the AMLBot brand, and is classified as a crypto‑scam. Analysis by VirusTotal shows that eight of ninety‑five scanners flagged the domain as malicious, and the domain appears on two independent blocklists.

Both PhishDestroy and ScamSniffer have recorded the domain as blocked. The SSL certificate is identified as “WE1”, confirming that TLS is in use but does not provide additional reputation signals. As of the report date, the domain is taken offline, which limits immediate threat exposure but suggests the operators may reactivate the infrastructure or reuse the same hosting assets.

Uncertainty remains regarding the specific payload or phishing pages that were served before takedown, as no visual or content inspection is available beyond the page title. Defenders should continue to monitor DNS queries for arnlguard.com and related sub‑domains, enforce blocklist entries, and consider flagging the associated Cloudflare IP range for heightened scrutiny. Any future resolution to the same IP should be treated as suspicious, and inbound traffic from that address should be inspected with standard crypto‑scam detection rules.