amlbot[.]lol

This domain, amlbot.lol, is assessed as a high-risk crypto scam impersonating AMLBot, a known brand in anti-money laundering services. Analysis indicates the domain was registered on September 11, 2025, through Web Commerce Communications Limited and is currently offline. Infrastructure analysis reveals it resolves to IP 172.67.153.131, hosted on Cloudflare's network (AS13335) in the US, with nameservers stanley.ns.cloudflare.com and vivienne.ns.cloudflare.com. No SSL certificate is present, which is atypical for legitimate financial or crypto-related services.

Detection data shows the domain appears on three security blocklists and is flagged by 12 of 95 security vendors on VirusTotal, though the absence of an SSL certificate and the generic page title 'Just a moment...' suggest it may have been caught in an intermediate or proxy state. AlienVault OTX lists it in one threat intelligence pulse, further corroborating its malicious classification. Defensive tools such as PhishDestroy, ScamSniffer, and Enkrypt have blocked this domain, and trust scores from Scamadviser (35/100) and Gridinsoft (0/100) indicate low legitimacy. Defenders should treat this domain as confirmed malicious infrastructure.

The lack of SSL and the use of Cloudflare nameservers are consistent with phishing campaigns aiming to obscure hosting origins. While the exact content of the site is not yet analysed, the available evidence—including blocklist presence, vendor detections, and impersonation of a crypto-focused brand—justifies immediate blocking at the DNS or proxy level. Monitoring for re-activation or related domains under the same registrar or nameserver infrastructure is recommended.