amlweb3[.]ink

On 24 July 2026, the domain amlweb3.ink was observed supporting a brand‑impersonation campaign targeting AMLBot. The domain was registered on 21 February 2026 and subsequently resolved to the IPv4 address 63.176.8.218, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The hosting provider is Amazon Web Services, indicating use of cloud infrastructure typical for rapid deployment. The site presented the page title “AMLBot – Crypto Compliance & Risk Management,” matching the targeted brand and confirming the intent to masquerade as an official AMLBot service. SSL analysis identified a certificate labeled “E6,” confirming that the site employed TLS encryption, but the certificate does not mitigate the underlying malicious purpose.

Reputation checks show the domain appears on two independent blocklists, specifically PhishDestroy and ScamSniffer, both of which have flagged the site as malicious. VirusTotal scans recorded two positive detections out of ninety‑three submitted security engines, reinforcing the classification as a crypto‑related scam. The campaign is currently listed as offline, suggesting the infrastructure has been taken down or is temporarily inaccessible. Defenders should continue to enforce deny‑list rules for both the domain and its resolved IP address, given the association with known blocklists and the positive VirusTotal detections.

Monitoring of Amazon‑hosted IP ranges for similar fast‑flux patterns is recommended, as is the inclusion of the observed page title in content‑based detection signatures. Because the site leverages legitimate TLS, network‑level inspection of encrypted traffic may be required to identify subsequent re‑hosted iterations. Awareness‑raising messages to users of AMLBot services should reference the exact page title to aid in distinguishing authentic communications from counterfeit pages.