amlbot[.]lat

This domain, amlbot.lat, is currently under investigation for credential theft phishing activity. Analysis indicates a targeted effort to harvest sensitive login credentials, likely through fraudulent login portals or deceptive authentication prompts. The domain’s infrastructure and lack of prior detection suggest an emerging or evasive campaign designed to bypass traditional security controls. Infrastructure analysis reveals the following technical indicators: amlbot.lat resolves to IP address 104.21.26.175, a Cloudflare-associated endpoint. The domain was registered on May 19, 2026, through Global Domain Group LLC, a registrar frequently utilized for newly deployed malicious infrastructure. VirusTotal reports 0/95 detections, indicating no prior flagging by security vendors. The domain remains active, utilizing a Let’s Encrypt SSL certificate to present a veneer of legitimacy. No blocklist entries or trust score downgrades were identified at the time of assessment, further complicating early detection efforts. Mitigation measures should focus on credential theft prevention. Network-level blocking of 104.21.26.175 and amlbot.lat is recommended for all egress points. Endpoint protection systems should be updated to flag or quarantine any process attempting to establish connections to this domain. User awareness training should emphasize the risks of entering credentials into unverified portals, particularly those mimicking enterprise authentication flows. Security teams are advised to monitor for anomalous authentication attempts or password reset requests originating from internal networks, as these may indicate successful credential harvesting from this domain.