amlbot[.]org[.]in

Analysis of amlbot.org.in indicates a confirmed crypto scam domain impersonating AMLBot, operational since February 27, 2026. The domain was registered through HOSTINGER operations, UAB, and resolves to IP address 82.29.186.223, hosted on AS47583 (Hostinger International Limited) in the United Kingdom. No SSL certificate was detected, increasing the risk of unencrypted data transmission. The page title, 'amlbot.org.in/', aligns with the domain name but provides no additional context regarding content or functionality. Infrastructure analysis reveals the use of nameservers ns1.dns-parking.com and ns2.dns-parking.com, a common configuration for low-cost or disposable hosting environments.

The domain is flagged by two security blocklists: PhishDestroy and ScamSniffer, both of which specialize in phishing and scam detection. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. While VirusTotal shows a detection from 1 of 93 security vendors, this limited visibility does not diminish the domain's confirmed presence on dedicated scam-tracking platforms. The domain's current status is offline, though historical activity suggests it was actively used for fraudulent purposes prior to takedown.

Defenders should treat this domain as a high-confidence threat targeting users of AMLBot, a cryptocurrency compliance service. The absence of SSL, use of parking-style nameservers, and hosting on a provider frequently associated with abuse reinforce its classification as a scam operation. Organizations should block the domain at the DNS level and monitor for related infrastructure, including the IP 82.29.186.223 and nameservers ns1.dns-parking.com/ns2.dns-parking.com, which may be reused for future campaigns. No evidence of a phishing kit or specific scam mechanics (e.g., crypto drainer, fake login) is available, but the domain's purpose aligns with typical brand impersonation tactics in the cryptocurrency sector.