amlbot[.]click

The domain amlbot.click was registered on 21 February 2026 through Web Commerce Communications Ltd. and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 172.67.188.216 located in the United States. DNS resolution uses the WebNIC nameservers ns100.webnic.cc and ns101.webnic.cc. An SSL certificate labeled WE1 is present, indicating a valid TLS handshake at the time of observation. The site is currently offline, which is reflected in the latest status check.

VirusTotal analysis shows that two out of ninety‑three scanning engines flagged the domain, and the domain appears on two independent blocklists, PhishDestroy and ScamSniffer. The threat profile categorises the activity as a crypto‑related scam that impersonates the AMLBot brand. No public page title, content snapshot, or JavaScript payload has been captured, so the exact phishing landing page design remains unknown.

The combination of recent registration, use of a reputable CDN, and low but non‑zero detection rate suggests an opportunistic campaign that may have been taken down or moved to a new host. Defenders should add amlbot.click to network‑level deny lists, monitor traffic to its Cloudflare IP for any residual connections, and enforce TLS inspection to capture any future re‑hosting attempts. Because the domain is already listed on multiple blocklists, existing security products that ingest those feeds will likely block it, but manual rule updates provide an additional safety net.