amlbot-scan[.]com

PhishDestroy identifies amlbot-scan.com as an active credential theft phishing domain impersonating legitimate security scan services to harvest user credentials. The domain leverages a generic but deceptive naming convention (amlbot-scan) to imply association with automated malware scanning bots, while its fraudulent login interfaces are designed to trick victims into surrendering account credentials. No evidence suggests the use of a specific drainer kit or brand impersonation at this stage; however, the site’s structure and SSL certificate (Let's Encrypt) indicate a semi-professional operation likely intended to facilitate immediate credential harvesting. amlbot-scan.com exhibits multiple suspicious technical indicators. According to VirusTotal, only 5 out of 95 security vendors have flagged the domain as malicious as of the most recent analysis. This low detection rate may reflect the domain's recency or evolving tactics. The domain was registered through Dynadot Inc on February 25, 2026, and currently resolves to IP address 104.21.90.220. While Google Safe Browsing (GSB) status remains unverified in this dataset, the presence of a valid Let's Encrypt SSL certificate suggests an attempt to establish trustworthiness. Additionally, the domain’s age and low blocklist count imply it has not yet been widely categorized across threat intelligence platforms. As of the latest assessment, amlbot-scan.com remains active and poses an elevated risk to users who may encounter it through phishing campaigns or misleading redirects. Immediate mitigation actions include blocking the domain at the network and DNS levels, updating firewall rules to restrict outbound connections to 104.21.90.220, and flagging the domain for takedown through the registrar (Dynadot Inc). Users are strongly advised to avoid accessing the site and to verify the legitimacy of any unexpected security scan prompts via official channels. Remaining risk stems from the domain’s recent creation and low initial detection rate, which may allow it to evade some security controls temporarily.