amlbotcompany[.]com

Analysis of amlbotcompany.com, observed offline as of the report date, indicates a deliberate brand‑impersonation campaign targeting the AMLBot service. The domain was registered on June 10, 2025 through NameSilo, LLC and resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. No SSL certificate is presented, and the site returns a non‑secure HTTP response. The page title returned from the server is "AML Bot," matching the declared brand target.

Infrastructure indicators show the domain is served by Cloudflare nameservers (JULIO.NS.CLOUDFLARE.COM and SHUBHI.NS.CLOUDFLARE.COM). Reputation services rate the site at a Gridinsoft trust score of 0 / 100, reflecting a high likelihood of malicious intent. VirusTotal reports a single detection out of 95 scanned security vendors, confirming at least one vendor flagged the domain as suspicious. The domain appears on two public security blocklists and has been listed in an AlienVault OTX pulse, reinforcing its association with malicious activity.

Additionally, both PhishDestroy and ScamSniffer have actively blocked the domain. The known scam type is a crypto‑related scam, though the exact payload or credential‑harvesting mechanism has not been publicly disclosed. Defenders should immediately block amlbotcompany.com and its resolved IP address at network perimeters, add the domain to internal blacklists, and monitor for any future use of the same Cloudflare nameservers or similar brand‑impersonation patterns. Continuous threat‑intel feeds should be consulted for updates, and any detection signatures derived from the single VirusTotal flag should be propagated to endpoint security solutions to improve coverage.