amlconfirm[.]site

Analysis of the domain amlconfirm.site reveals infrastructure consistent with a crypto scam impersonating an 'AML Bot' service, as indicated by the page title 'AML Bot' and the scam type classification in available threat intelligence. The domain was registered on March 23, 2026, through Web Commerce Communications Limited (WebNic.cc), a registrar frequently associated with high-risk domains. It resolves to Cloudflare IP 188.114.97.3, hosted in Canada, and employs Cloudflare nameservers (anita.ns.cloudflare.com, marvin.ns.cloudflare.com), which are common among threat actors leveraging Cloudflare's proxy services to obscure origin infrastructure. No SSL certificate was detected, increasing the likelihood of interception or redirection in man-in-the-middle scenarios.

The domain is currently offline, having been taken down following detection by at least one security blocklist (PhishDestroy) and flagged by 16 of 94 security vendors in VirusTotal scans. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. Technologies identified include Vue.js and Cloudflare Browser Insights, which may have been used to create a dynamic frontend or track user interactions, though the exact functionality of the site remains unconfirmed due to its offline status. Defenders should treat this domain as a confirmed crypto scam asset, particularly given its association with 'AML Bot' branding and the absence of legitimate use cases.

The reliance on Cloudflare infrastructure, combined with the lack of SSL and recent registration, aligns with known patterns of fraudulent domains designed for short-term abuse. While the domain is no longer active, historical DNS and WHOIS records should be preserved for forensic analysis, and any residual references to amlconfirm.site in logs or communications should be investigated as potential indicators of compromise. Further monitoring of related domains registered through WebNic.