Is amlstatus.us a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

AMLBotChecker presents itself on its homepage as a provider of "reliable AMLBot solutions for DeFi compliance", a service pitched at crypto and decentralized-finance users who want anti-money-laundering screening. The page carries a substantial amount of text but is not tied to any named company or product vendor. It is served from a newly registered domain whose name, amlstatus.us, differs from the brand shown in the page title, and its apparent purpose is to attract users seeking compliance or wallet-screening checks.

Scam/Impersonation Risk

Reputation sources show confirmed adverse signals for this domain. Several independent detection engines currently rate it malicious, and a further engine rates it suspicious. One of these is a top-tier network-security vendor, so the detections are not confined to low-quality feeds. Together they amount to a blacklisting that the available evidence does not explain or discount. No identity contradiction was observed, because the evidence contains no conflicting legal-entity names. No wallet-draining behavior, clipboard manipulation, hidden forms or cloaking was seen in the sandbox runs. The risk therefore rests on the blacklist, not on a proven attack mechanism. Two further factors raise the concern. The domain is only months old, with almost no independent history. The branding shown on the homepage ("AMLBotChecker", a name echoing an established compliance-tool category) does not match the domain name. A compliance-themed lure aimed at DeFi users is a recognized pattern for deceiving people into trusting a site with wallet or account details. These facts do not prove impersonation, but they justify a security-forward stance. Evidence:

• Homepage: the page title advertises "AMLBotChecker: Reliable AMLBot Solutions for DeFi Compliance" on a domain named amlstatus.us, a brand-to-domain mismatch.
• Domain reputation: five engines report the domain as malicious and one as suspicious, with a tier-one vendor among those flagging it.
• Provenance: the domain was registered on 2026-04-09 (~0.55 years old), and the web archive holds only 2 snapshots, both from 2026-09-03 (1 year tracked).

Regulatory Verification Notes

The site markets compliance-related services, yet no licensing, registration or regulatory identifier could be tied to it. No third-party regulatory source confirms the operator, and no broker-reputation record matches the domain. This is a verification gap, not evidence of wrongdoing on its own. The WHOIS record lists a registrant called "citrust 619" with an organization of "Itech". Nothing on the site links either name to the brand presented on the page, so the operator's real-world identity remains unconfirmed. The adverse reputation signals above are the reason this gap matters more than it would on a neutral site. Evidence:

• Registration: the domain is registered through Namecheap, and the WHOIS record expires 2027-04-09.
• Hosting: the site is served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: the TLS certificate is domain-validated only (DV), issued by WE1 and valid to 2027-01-02. This confirms encryption but says nothing about who operates the site.

What to Verify Next

Before any interaction, confirm independently whether a service branded AMLBotChecker exists, through the official channel of the established compliance-tool provider it appears to echo, and check that this domain is listed there. Check any claimed licence or registration number against the relevant public registry, and obtain the operator's legal name through an offline or independently sourced route. Confirm the official support and contact channels the same way. Do not rely on contact details published on this site. The sandbox session showed one further matter worth clarifying: the site contacts third-party services extensively, so any data entered would likely leave the domain. Any such data flow should be understood before use. Evidence:

• Behavior: 11 external XHR requests and 4 external POST requests were recorded, and external traffic reached 98.7% of requests at its peak.
• Behavior: the sandbox logged 70 console errors across 3 successful runs, indicating a poorly stabilized or heavily scripted page.
• Behavior: no wallet connection, drainer or clipboard-write activity was triggered in any run.

Summary Verdict

The overall posture is high-risk. The adverse reputation evidence is decisive, and the newness of the domain and the lack of confirmed identity reinforce it. The supporting technical hygiene is unremarkable and does not offset this.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge servers, so the origin host was not visible in this analysis. This setup is common and mildly mitigating, since it shows a functioning, encrypted deployment. It does not vouch for the operator's intent, and edge-only visibility also prevents independent hosting verification and can make rapid content changes harder to detect.

Closing Assessment

Treat the site as unsafe for any sensitive action. Do not log in, enter credentials, connect a wallet or make payments or other financial transfers. At most, limit use to passive, read-only viewing, and run any compliance screening through a service reached by an independently verified route.