amllbot[.]io

Analysis of the domain amllbot.io indicates a confirmed wallet seed phishing campaign targeting users of the Foundation platform. The domain was registered on October 22, 2025, through NameSilo, LLC, and resolves to the IP address 94.154.172.94, hosted under AS209101 (IP Vendetta Inc.) in the Netherlands. Infrastructure analysis reveals the use of nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com, a common pattern in phishing operations leveraging bulletproof hosting services. The page title, 'AML Bot — Fast & Secure AML Verification,' suggests an attempt to impersonate a legitimate AML verification service, though the exact content and functionality of the site remain unverified due to its current offline status.

Detection data from July 25, 2026, shows limited but targeted flagging: two of 95 security vendors on VirusTotal identified the domain as malicious, and it appears on one security blocklist. AlienVault OTX includes the domain in a single threat intelligence pulse, further corroborating its association with phishing activity. The domain lacks an SSL certificate, a red flag for user security, and has a Gridinsoft trust score of 0/100, indicating high risk. PhishDestroy has blocked access to the domain, which is now offline, though defenders should monitor for potential re-emergence under the same or similar infrastructure.

The scam type is classified as wallet/seed phishing, a method used to harvest cryptocurrency wallet credentials or recovery phrases. Given the domain's registration details, hosting provider, and detection history, defenders are advised to treat amllbot.io as a confirmed malicious entity. Network-level blocking of the IP 94.154.172.94 and associated nameservers is recommended to mitigate further risk. Organizations should also review logs for connections to this domain or IP, particularly in environments where Foundation or AML-related services are accessed.