digital[.]crypto-connectweb3[.]com

Analysis indicates that the domain digital.crypto-connectweb3.com was actively impersonating AMLBot, a cryptocurrency compliance service, as of its registration on February 21, 2026. The domain was hosted on infrastructure associated with Namecheap, Inc. (AS22612), resolving to the IP address 209.74.76.6, located in Great Britain. No SSL certificate was detected, increasing the risk of interception or manipulation of user data. The page title explicitly matched the targeted brand, 'AMLBot,' confirming the intent to deceive users into believing they were interacting with the legitimate service.

At the time of assessment, the domain was flagged by two of the 93 security vendors on VirusTotal and appeared on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, which classify it as malicious infrastructure. The domain was registered through Spaceship, Inc., with nameservers launch1.spaceship.net and launch2.spaceship.net, further linking it to known phishing-enabling providers. As of July 25, 2026, the domain has been taken offline, though its prior activity and infrastructure remain relevant for historical threat tracking.

Defenders are advised to block the domain, its resolved IP, and associated nameservers at the network level. Security teams should review logs for connections to 209.74.76.6 or requests to digital.crypto-connectweb3.com, particularly from users who may have engaged with cryptocurrency-related services. While the domain is no longer active, its registration details and hosting history provide actionable indicators for detecting similar phishing campaigns targeting AMLBot or other crypto compliance platforms.