am1bot[.]cfd

The domain am1bot.cfd is currently active and classified as a high‑risk generic phishing infrastructure targeting investors. The site resolves to IP address 104.21.52.212, which is hosted by Cloudflare, Inc. in Canada and uses Cloudflare’s DNS resolvers eleanor.ns.cloudflare.com and leonidas.ns.cloudflare.com. The TLS certificate is issued by Let’s Encrypt (E8), and the HTTP response returns status code 200, indicating the site is reachable. The page title retrieved from the site is "AMLBot vs AM1Bot: Critical Analysis of Dex Security Risks," suggesting the content is framed as a security analysis but the underlying intent aligns with the listed scam type of an investment scam. The domain was created on May 03 2026 and has already appeared on one security blocklist; it is also listed by PhishDestroy. VirusTotal analysis shows that 13 of 91 scanning engines flagged the domain, reinforcing the suspicion of malicious activity. Automated reputation scoring from Gridinsoft assigns a trust score of 0 out of 100. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, all consistent with the hosting provider. While the exact phishing kit or credential‑harvesting mechanisms have not been disclosed, the convergence of hosting, low trust score, multiple vendor detections, and the investment‑scam label warrants immediate defensive action. Network defenders should block the domain and its associated IP at perimeter controls, monitor for outbound connections to the IP, and incorporate the domain into threat‑intel feeds. Continuous re‑evaluation is advised, as further indicators may emerge from future analyses.