amlbot-crypto[.]one

The domain amlbot-crypto.one is currently active and resolves to the IPv4 address 172.86.70.33, which GeoIP maps to Germany and is associated with the organization FranTech Solutions. The domain was registered on 30 March 2026 via Dynadot Inc and uses the generic dyn‑ns pair ns1.dyna‑ns.net / ns2.dyna‑ns.net. No TLS certificate is presented, and the web server returns HTTP 200 with a page title reading “AMLBot – Comprehensive Crypto Compliance Solution | Free AML Crypto Check”. The content explicitly references the AMLBot brand, indicating a brand‑impersonation campaign aimed at an investment‑type scam. Infrastructure analysis shows a stack of Node.js, Ubuntu, React, Nginx, Next.js and Webpack, consistent with a modern web application. Security telemetry shows a Gridinsoft trust score of 0/100 and a single detection by VirusTotal (1 of 94 vendors flagged). The domain is listed on one public blocklist and has been blocked by the PhishDestroy sink‑hole. Defenders should treat amlbot-crypto.one as high‑risk. Immediate actions include adding the domain and its IP to outbound deny lists, monitoring DNS queries for the associated nameservers, and flagging any email or web traffic that references the AMLBot brand. Because the site lacks SSL, interception of traffic is technically feasible, but the lack of a certificate also reduces user trust signals. Continuous monitoring of the host’s activity and correlation with other AMLBot‑related abuse reports is recommended to detect potential expansion of the campaign.