amlrobotcheck[.]com

On 24 July 2026, the domain amlrobotcheck.com was observed serving HTTP 200 responses before being taken offline. The site presented the page title “AMLBot - The full-fledged crypto compliance solution”, directly referencing the AMLBot brand and indicating an investment‑scam motive. Registration data shows the domain was created on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses four RegWay nameservers (dns1–dns4.regway.com). No TLS certificate was deployed, leaving the site accessible only via plain HTTP. DNS resolution points to IP 193.58.121.240, which belongs to AS215439 PLAY2GO INTERNATIONAL LIMITED and is geolocated in Germany.

The hosting infrastructure does not appear to be shared with known legitimate AMLBot services. Multiple threat‑intelligence feeds have flagged the domain. Two of ninety‑three VirusTotal scanners raised detections, and the domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer, which have categorized it as an investment‑scam impersonating AMLBot. No additional evidence such as Safe Browsing or OTX entries were recorded at the time of analysis. The absence of an SSL certificate, combined with the brand‑specific page title and the rapid registration-to‑take‑down timeline, suggests a short‑lived abuse campaign designed to harvest credentials or solicit funds from entities seeking crypto‑compliance solutions.

Uncertainty remains regarding the exact payload delivered to visitors, as the site content has not been archived. Analysts should treat any URLs or emails referencing amlrobotcheck.com as hostile, block the domain at perimeter defenses, and monitor the associated IP address for future activity. Continuous re‑query of reputation services is advised to capture any re‑use of the infrastructure. Organizations using AMLBot services should verify that no credential changes have occurred and consider implementing multi‑factor authentication for their compliance portals.