reportwallet[.]com

Analysis of the domain reportwallet.com indicates a confirmed brand‑impersonation campaign targeting the AMLBot brand. The site was created on February 21, 2026 and is currently offline, which aligns with the “taken offline” status reported by threat intel. The page title retrieved from historical snapshots reads “Report Wallet | AML Check,” directly referencing AML verification terminology that could be used to lure victims into a crypto‑related scam. The domain is registered through NameCheap, Inc. and resolves to the IP address 172.67.141.131, which belongs to the Cloudflare network (AS13335) and is geolocated to the United States.

No SSL certificate is present, meaning any HTTPS connections would be terminated or forced to HTTP, a typical characteristic of hastily deployed malicious infrastructure. The domain appears on one security blocklist and has been flagged by PhishDestroy, reinforcing its malicious classification. VirusTotal scans show that a single vendor out of ninety‑five flagged the domain, providing an additional, albeit limited, indicator of risk.

The available evidence does not include Safe Browsing, OTX, or additional trust‑score metrics, leaving the broader detection landscape partially unknown. Defenders should immediately block the domain and its associated IP at perimeter and DNS filtering layers, add the host to internal threat‑intel feeds, and monitor for any newly registered subdomains or similar domains using the same registrar or Cloudflare edge. Continuous re‑evaluation is advised, as the offline status may change and further malicious content could appear if the operators reactivate the site.