amlbotcheck-io[.]pages[.]dev

The domain amlbotcheck-io.pages.dev impersonates AMLBot, a legitimate AML screening service, to conduct an AML scam. Detected by PhishDestroy on the same day it was created, March 28, 2026, this domain is already flagged by 6 out of 94 vendors on VirusTotal. The site poses as a TRON AML screening tool, misleading users into believing they are engaging with a trusted service.

Hosted by Cloudflare, Inc., the domain's IP address is located in Canada. It uses a Let's Encrypt SSL certificate, which is common for both legitimate and malicious sites. The platform risk score is notably high at 83 out of 100, indicating a significant threat level. The domain is also listed on one public blocklist, maintained by PhishDestroy.

This phishing operation targets users seeking to verify the risk associated with cryptocurrency wallets, exploiting their trust in AMLBot's brand. By mimicking the appearance and functionality of a genuine AML screening service, the site aims to extract sensitive information under the guise of a security check. The early detection by PhishDestroy highlights the importance of identifying and neutralizing such threats before they can propagate widely. The domain's activity underscores the ongoing challenges in combating phishing scams, particularly those leveraging brand impersonation.