web-aml-bot[.]com

This domain, web-aml-bot.com, is flagged as a crypto drainer phishing campaign targeting users through the impersonation of ZYNX TOOLS, a purported provider of professional game utilities. Analysis indicates the site is designed to deceive visitors into connecting cryptocurrency wallets under the pretext of offering gaming tools, subsequently draining funds through malicious smart contract interactions. The threat is classified as a crypto asset theft operation, leveraging social engineering to exploit users seeking third-party game modifications or enhancements. Infrastructure analysis reveals the domain was registered on February 20, 2026, through Dynadot Inc, an uncommonly future-dated creation that may indicate an attempt to evade reputation-based detection systems. The domain resolves to the IP address 107.189.23.64 and is currently associated with a Let's Encrypt SSL certificate, providing a superficial layer of legitimacy. Detection metrics confirm elevated risk: the domain is flagged by 5 out of 95 security vendors on VirusTotal and appears on three independent security blocklists. Additionally, it has been proactively blocked by at least three endpoint protection mechanisms, further validating its malicious classification. Users who visited web-aml-bot.com or interacted with its content are advised to take immediate remediation steps. Any cryptocurrency wallets connected to the site should be considered compromised; users must revoke all active smart contract approvals and transfer remaining assets to a new, secure wallet. System scans using updated security tools are recommended to detect potential secondary infections. Due to the offline status of the domain, the campaign may have concluded its active phase, but residual risk persists for users who engaged with the site prior to takedown. Monitoring for unauthorized transactions and enabling multi-factor authentication on all financial accounts is strongly advised.