aml-cryptobot[.]top

Analysis of the domain aml-cryptobot.top indicates a crypto scam operation impersonating CSGO, with infrastructure and detection patterns consistent with fraudulent activity. The domain was registered on February 21, 2026, and was observed with the page title 'AML Check,' suggesting an attempt to mimic anti-money laundering verification processes commonly associated with cryptocurrency platforms. As of July 22, 2026, the domain is offline, but prior infrastructure analysis reveals it resolved to the IP address 104.21.78.237, hosted on Cloudflare's network (AS13335) in the United States. This hosting provider is frequently leveraged by threat actors to obscure the true origin of malicious domains.

Security vendors have flagged the domain on two blocklists, including PhishDestroy and ScamSniffer, which specialize in phishing and scam detection. VirusTotal data shows that 2 out of 93 security vendors classified the domain as malicious, though this limited detection rate does not rule out the possibility of evasion techniques or recent emergence. The SSL certificate, issued under the identifier 'WE1,' does not provide additional trust signals, as such certificates are commonly used for both legitimate and malicious domains. Gridinsoft assigned a trust score of 0/100, reinforcing the domain's high-risk classification.

While the exact mechanics of the scam remain unconfirmed due to the domain's offline status, the combination of brand impersonation (CSGO), crypto-themed page title, and detection by specialized scam-blocking services strongly suggests an intent to defraud users through fraudulent cryptocurrency transactions or credential harvesting. Defenders should treat this domain as malicious and include it in blocklists, particularly in environments where CSGO or cryptocurrency-related activities are prevalent. Further monitoring of associated infrastructure, such as the resolving IP and SSL certificate, may reveal additional linked domains or campaigns.