start-amlbot[.]initiatescreening[.]com

Analysis of start-amlbot.initiatescreening.com indicates a brand impersonation campaign targeting AMLBot, a crypto compliance platform. The domain was registered on February 21, 2026, and has since been flagged by three security blocklists, including PhishDestroy, ScamSniffer, and Enkrypt. The page title, 'AMLBot - The full-fledged crypto compliance solution,' directly mirrors the branding of the legitimate service, suggesting an intent to deceive users into engaging with fraudulent compliance or verification processes. Infrastructure analysis reveals the domain resolved to 198.54.126.119, an IP address hosted by Namecheap, Inc. (AS22612) in the United States.

The SSL certificate, issued by Sectigo RSA Domain Validation Secure Server CA, does not inherently validate the domain's legitimacy, as phishing sites frequently use valid certificates to appear trustworthy. At the time of this report, the domain is offline, though this status may change; defenders should not assume permanent inactivity. No detections were recorded by the 93 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety.

The domain's classification as a crypto scam aligns with the broader trend of threat actors exploiting compliance-themed lures to target users in the cryptocurrency sector. Defenders are advised to monitor for re-emergence, block the domain at perimeter security controls, and alert users to the impersonation risk. Further investigation into the hosting infrastructure and any associated email or payment redirection is recommended to identify linked threat activity.