sync-aml[.]one

Analysis of the domain sync-aml.one, created on February 21 2026 and currently taken offline, indicates a high‑risk brand‑impersonation campaign targeting users of AMLBot. The site presented the page title “AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check,” directly mirroring the legitimate brand’s messaging and suggesting an investment‑scam vector. Infrastructure analysis shows the domain resolves to IP 172.86.94.172, hosted in Germany and announced by ASN AS30823 belonging to aurologic GmbH. No TLS certificate was observed, and HTTP requests return a 404 status, confirming the site is no longer serving content.

The domain is registered through Dynadot LLC and uses the public nameservers ns1.dyna‑ns.net and ns2.dyna‑ns.net. Reputation services have flagged the domain: seven security blocklists list it, Google Safe Browsing classifies it as social‑engineering, and VirusTotal recorded detections from 16 of 95 scanners. Additional blocklists from PhishDestroy, MetaMask, ScamSniffer, Polkadot and SEAL also block the domain.

While the exact phishing page layout and credential‑capture mechanisms remain unverified, the presence of a targeted page title, the brand reference, and the investment‑scam label provide sufficient evidence of malicious intent. Defenders should add sync‑aml.one to URL filtering and domain‑blocking policies, monitor DNS queries for the associated IP range, and alert users about the fraudulent AMLBot impersonation. Ongoing telemetry should be collected to detect any resurgence, and any further infrastructure changes should be re‑evaluated against threat‑intel feeds.