scan-usdt[.]org

Analysis of scan-usdt.org indicates an active crypto‑scam infrastructure that masquerades as the AMLBot service. The domain was registered on March 6, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 172.67.214.117, which is owned by AS13335 (Cloudflare, Inc.) and geolocated to the United States. No TLS certificate is presented, leaving the site without HTTPS protection. The authoritative nameservers are grannbo.ns.cloudflare.com and kyree.ns.cloudflare.com, both belonging to Cloudflare’s DNS service.

The page title returned by the server is "Web3 AML Checker," aligning with the declared scam type of a crypto‑related fraud. VirusTotal scans show three of ninety‑four security vendors flagging the domain, confirming a low‑to‑moderate detection rate. The site has been listed on at least one public blocklist and was specifically blocked by the PhishDestroy feed, indicating that upstream defenders have already taken mitigation steps. Current operational status is offline, which may be temporary or indicative of takedown activity.

Uncertainty remains around the exact phishing payload or credential‑harvesting mechanisms, as no page content has been publicly captured. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP range for any resurgence, and update endpoint protection signatures with the observed indicator set. Additional telemetry such as HTTP response codes, content hashes, or sandbox analysis would be valuable to confirm the malicious functionality and to refine detection rules. Organizations using AMLBot or related Web3 compliance tools should advise users to verify URLs against official sources and to avoid interacting with any site presenting a "Web3 AML Checker" interface that does not originate from the legitimate service.