amlstatement[.]info

Analysis of amlstatement.info indicates a high-risk brand impersonation campaign targeting AMLBot, a crypto compliance platform. The domain was registered on February 21, 2026, through Porkbun LLC and remains active as of July 23, 2026. It resolves to IP 144.124.231.90, hosted on AS216071 (SERVERS TECH FZCO) in the Netherlands, with nameservers under Porkbun's infrastructure. The SSL certificate is issued by Let's Encrypt (serial E8), and the server returns an HTTP 403 status, suggesting access restrictions or defensive measures against automated scans. Detection data reveals 16 of 93 security vendors on VirusTotal flagging the domain, while Google Safe Browsing classifies it as social engineering.

The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. The page title, 'AML Check - The full-fledged crypto compliance solution,' directly mirrors AMLBot's branding, confirming the impersonation vector. Detected technologies include Ubuntu, Nginx, Unpkg, jsDelivr, and jQuery, which are common in phishing kits but not exclusive to malicious activity. Defenders should treat this domain as confirmed malicious.

Block resolution at the DNS level and monitor for connections to 144.124.231.90 or related AS216071 infrastructure. The HTTP 403 response may indicate evasion tactics, so retrospective log analysis for prior connections is advised. While the exact scam mechanics remain unconfirmed, the combination of brand impersonation, crypto compliance themes, and detection metrics justifies immediate containment. No evidence suggests compromise of legitimate AMLBot infrastructure, but users should verify communications via official channels only.