amlreview[.]io

This domain, amlreview.io, is flagged as a brand impersonation threat targeting Bitget, a cryptocurrency exchange platform. Analysis indicates the site masqueraded as an "AML Suite" tool, specifically titled "Check Wallet - AML Suite," likely designed to deceive users into interacting with fraudulent wallet verification or anti-money laundering processes. The infrastructure and page design suggest an attempt to exploit trust in legitimate AML compliance tools, potentially facilitating unauthorized access to cryptocurrency wallets or sensitive user data. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was created on March 17, 2026, and is registered through Global Domain Group LLC. It resolves to the IP address 188.114.96.3, with a VirusTotal detection score of 5/95 security vendors flagging it as malicious. The domain appears on one security blocklist and is associated with technologies including Vue.js, jsDelivr, Cloudflare Browser Insights, and Cloudflare’s HTTP/3 protocol. The SSL certificate is issued by Let’s Encrypt, a common but not exclusive indicator of legitimacy, often exploited in phishing campaigns to appear trustworthy. As of the latest assessment, amlreview.io has been taken offline, likely in response to security vendor interventions or registrar enforcement actions. However, the elevated risk persists due to the domain’s recent creation, association with known impersonation tactics, and residual detection by security platforms. Users and organizations are advised to monitor for similar domains registered under the same registrar or resolving to the identified IP address. Blocking or flagging domains with comparable infrastructure patterns, such as Cloudflare-hosted sites impersonating financial services, is recommended to mitigate further exposure.