Is amlbot.info a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website, served under the domain name amlbot.info, did not present any ordinary site content to the visitor. The only page returned was a security interstitial titled as a suspected-phishing warning, which blocked access to the site itself. No products, services, pricing, account flows or corporate narrative were rendered, so the site's purpose and business model cannot be established from what it displayed.

Scam/Impersonation Risk

The dominant finding is a confirmed blacklist listing. Several independent threat-intelligence engines currently flag the domain as malicious, and two tier-one security vendors are among them. This is a hard contradiction and the decisive reason for the cautionary posture. No conflicting legal entities or brand impersonation were observed, so the risk rests on reputation rather than on identity inconsistency. The interstitial shown in place of the homepage independently points in the same direction. Behavioral testing showed an unusually heavy share of third-party network requests. It also showed a high volume of browser console errors and a large burst of page changes after interaction, which is consistent with an unstable or heavily scripted page. Testing did not detect wallet-draining behavior, clipboard manipulation, hidden forms or credential posts to outside parties. These absences slightly narrow the observable attack surface, but they do not offset the reputation findings. The domain's provenance is also inconsistent. The current registration is recent, yet the web archive shows captures reaching back several years. This pattern suggests a lapse and re-registration, or a change of control, and warrants caution with any dormant domain. Evidence:

• Homepage: returned an interstitial titled as a suspected-phishing warning instead of site content.
• External reputation: 6 engines classify the domain as malicious and 1 as suspicious, including two tier-one vendors.
• Behavioral testing across 3 runs: 91 external XHR/fetch calls, 9 external POSTs, 30 console errors and a 1,523-mutation DOM change after interaction. No wallet-drainer, clipboard or hidden-form activity was detected.
• Provenance: current registration created 2026-04-21 (~0.5 years old), while 8 archive snapshots span 2022–2026 (5 years tracked).

Regulatory Verification Notes

No licensing, registration or regulatory standing is associated with this domain, and the site presented no legal, terms or about content from which an operator could be identified. The real-world operator therefore remains unconnected to the domain. Registration details are not publicly attributable to a named owner, which is ownership opacity. That is an administrative limitation and not an identity contradiction. It matters here only because it removes any accountable party that could answer the reputation findings. No third-party broker or regulator match exists for the domain. The transport encryption is valid, but it only shows that the connection is encrypted and says nothing about the operator's legitimacy. Evidence:

• Registrar: Nicnames, Inc.; registration runs to 2027-04-21.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• TLS: certificate issued by YE2 (DV, domain-validated only), valid to 2027-01-13.
• No broker-database or regulator match was found for the domain.

What to Verify Next

Any interaction should wait until the operator is identified and the listings are resolved. Check the current status of the threat listings with the individual security vendors who flagged the domain, since a cleared listing materially changes the picture. Establish the operator's identity through an independent route, such as a known official channel obtained from outside this domain, and do not rely on anything reached through it. Where a regulated activity is claimed, confirm authorization directly with the relevant registry. Evidence:

• The vendors currently flagging the domain are the authoritative source for whether the listing has been cleared.
• No operator identity or licensing claim was visible on the site, so none can be checked against a registry yet.

Summary Verdict

The overall posture is high risk. Confirmed adverse reputation from multiple independent sources outweighs the technically sound transport security and the absence of any detected drainer or credential-theft mechanics. The site's identity and purpose are unverified, and the evidence does not support treating it as a legitimate counterparty.

Infrastructure Integrity

The domain is fronted by Cloudflare's CDN and WAF, and all observed addresses are edge servers. The origin server was not observable, which prevents independent verification of where the content actually resides. This protective layer is a mitigating factor only, and it cannot offset the external threat detections.

Closing Assessment

The site should not be used for logins, credential entry, payments or any financial interaction, and nothing should be downloaded from it. Any contact should be limited to passive, read-only viewing from an isolated environment, until the threat listings are cleared and an accountable operator is independently identified.