anlscaner[.]com

Analysis of anlscaner.com, a domain flagged for brand impersonation targeting the CS:GO gaming community, indicates elevated risk due to confirmed crypto scam activity. The domain, registered on April 15, 2025, through NameSilo, LLC, was taken offline prior to this assessment but previously resolved to IP 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335). Infrastructure analysis reveals the use of Cloudflare nameservers (EVA.NS.CLOUDFLARE.COM and GUY.NS.CLOUDFLARE.COM), a common tactic to obscure hosting origins and evade takedowns. No SSL certificate was detected, increasing the likelihood of unencrypted data transmission, though this is not uncommon for low-effort scam sites.

Detection data from security vendors confirms malicious intent: 8 of 95 engines on VirusTotal flagged the domain, and it appears on two blocklists, including PhishDestroy and ScamSniffer. The page title, 'AML Bot,' suggests a fraudulent automation tool, likely marketed as a cryptocurrency-related service to exploit users. While the exact content of the site remains unanalyzed, the combination of brand impersonation, crypto scam classification, and blocklist presence provides strong evidence of malicious activity. Defenders should treat this domain as compromised and maintain its inclusion on blocklists.

Organizations targeting gaming or cryptocurrency communities should monitor for similar infrastructure patterns, such as Cloudflare-hosted domains with recent registrations and no SSL. Given the domain's current offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential investigations. The absence of an SSL certificate and the use of a known bulletproof registrar (NameSilo) are additional red flags warranting heightened scrutiny.