web3-amlbot[.]xyz

PhishDestroy identifies web3-amlbot.xyz as an active crypto drainer scam operating under the guise of a Web3 AML compliance tool. This domain specifically targets cryptocurrency users by masquerading as a legitimate verification service, luring victims into connecting their wallets to drain funds via malicious smart contract interactions. The threat actor leverages time-sensitive language (e.g., 'urgent compliance check') and spoofed branding to manipulate users into granting permissions to malicious dApps. Technical analysis reveals this domain resolves to IP 104.21.56.147 and utilizes a Google Trust Services SSL certificate to appear legitimate, enhancing its ability to bypass browser warnings. This domain was flagged by 3 out of 95 VirusTotal security vendors, indicating limited but concerning detection coverage. Registered through Dynadot LLC on February 08, 2026, the domain’s recent creation and low blocklist count suggest it is part of an emerging campaign. The combination of a newly registered domain, reliance on a trusted SSL provider, and minimal detections highlights the sophistication of this operation in evading traditional security measures. Users interacting with this domain risk irreversible cryptocurrency losses due to unauthorized wallet access. If you visited web3-amlbot.xyz, immediately revoke any wallet permissions granted to the domain through your wallet’s connection settings (e.g., MetaMask, WalletConnect). Disconnect the site and clear browser cache/cookies to remove stored session data. Report the domain to your antivirus provider and block it via firewall or hosts file. For further protection, enable hardware wallet signing for transactions and use tools like Etherscan or DeBank to monitor suspicious activity. Stay vigilant against unsolicited Web3 compliance requests, as legitimate services never require urgent wallet connections.