amlsecure[.]today

On July 25, 2026, analysis of the domain amlsecure.today indicates that it is a brand‑impersonation site targeting the AMLBot service. The domain is registered through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.67.163.52, which belongs to AS13335 in the United States. The authoritative nameservers are dave.ns.cloudflare.com and lily.ns.cloudflare.com, confirming that the domain is fully hosted on Cloudflare’s infrastructure. No SSL certificate is presented for the domain, and the site is currently offline, meaning that HTTP(S) requests return no content. The page title that was observed before the takedown is “AML Bot - Network Selector,” which aligns with the claimed impersonation of AMLBot.

Reputation checks show a Gridinsoft trust score of 0 out of 100, indicating an extremely low trust rating. Four of ninety‑five VirusTotal scanners flagged the domain, reinforcing the suspicion of malicious activity. The domain appears on four independent security blocklists and has been explicitly blocked by the PhishDestroy, Polkadot, Enkrypt, and Codeesura filtering services. These blocklist entries provide independent confirmation that the domain is being used for a crypto‑related scam, as indicated by the “Crypto Scam” classification in the intelligence feed.

Because the domain lacks a valid TLS certificate and is offline, further content‑level analysis (such as HTML inspection or credential‑harvesting forms) cannot be performed at this time. The primary evidence supporting the threat assessment consists of the hosting information, the low trust score, the blocklist listings, and the partial VirusTotal detections. Defenders should add amlsecure.today to DNS‑ and URL‑filtering policies, monitor the associated IP address for any future activation, and consider the associated Cloudflare nameservers as potential vectors for rapid re‑deployment.