{"investigation":{"slug":"fake-crypto-aml-checker-drainer-campaign","entity_name":"Fake Crypto AML Checker Drainer Campaign","trust_score":1,"severity_base":null,"score_modifier":-9,"confidence":0.75,"status":"published","content_type":"investigation","summary":"A cluster of phishing websites poses as cryptocurrency wallet anti-money-laundering (AML) screening tools, some impersonating the legitimate service AMLBot and others using generic names such as 'AML Check,' to trick visitors into connecting a wallet and approving a malicious transaction that drains its funds. Malwarebytes documented the pattern in August 2026, AMLBot has separately warned customers about look-alike domains, and malware-removal sites such as PCRisk have catalogued dozens of related fraudulent domains since at least mid-2025. No single operator, loss total, or on-chain trace of stolen funds has been publicly confirmed; the entity here is a recurring scam technique and domain cluster rather than one identified company or person.","sections":[{"content":"Fake AML-checker sites invite visitors to select a cryptocurrency and click a button such as 'Check Wallet' or 'Generate Report.' The site then asks the visitor to connect a wallet, uses the revealed public address to construct a transaction, and prompts the victim to approve it. According to Malwarebytes, approving this transaction can grant the site's underlying smart contract permission to spend tokens held in the wallet, commonly with no time limit, which is the actual mechanism by which funds are stolen rather than any real AML analysis taking place. Some variants show a fake progress bar and status messages, then an invented error demanding a small payment to 'cover the fee' before returning a reassuring 'Clean, Low Risk' result regardless of whether any check occurred. Malwarebytes found the same site template reused under different names and logos, indicating a shared phishing kit rather than one-off copies. PCRisk's description of a related fake AMLBot site is consistent with this: visitors who click 'Generate Report' are prompted to connect a wallet and unknowingly sign a contract that enables a cryptocurrency drainer, after which funds are moved to attacker-controlled wallets, often without the victim noticing immediately.","heading":"How the scam works","sources":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Malwarebytes, 'Scammers are using fake crypto AML checkers to drain your wallet'","type":"research","credibility":2},{"url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","name":"PCRisk, 'How to avoid getting scammed by fake \"AMLBot Crypto Checking\" sites'","type":"research","credibility":2},{"url":"https://www.pcrisk.com/removal-guides/32520-fake-amlbot-website-scam","name":"PCRisk, 'Fake AMLBot Website Scam'","type":"research","credibility":2}],"severity":"critical"},{"content":"Many of the fraudulent sites copy the branding, logo, and layout of AMLBot, a real cryptocurrency wallet-screening service operating at amlbot.com, while other sites use generic names such as 'AML Check' with no specific brand to impersonate. AMLBot has published its own warning stating that its services are available only through amlbot.com and a verified Telegram bot, that it will never ask users to connect a wallet to perform an AML check, and that it does not charge for unsolicited crypto-recovery services. The company's post is dated April 16, 2025, with a listed update of November 2, 2026, indicating the impersonation problem has been ongoing and was still being tracked as of that update. Separately, Malwarebytes' August 2026 report lists domains that imitate other brands as well, including one styled as 'bitget-aml[.]com,' suggesting the technique is applied opportunistically across multiple recognizable crypto-industry names rather than targeting AMLBot exclusively.","heading":"Impersonation of AMLBot and other brands","sources":[{"url":"https://blog.amlbot.com/dont-get-tricked-by-fake-amlbot-platforms-protect-your-crypto-from-scammers/","name":"AMLBot blog, 'Don't Get Tricked by Fake AMLBot Platforms'","type":"official","credibility":1},{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Malwarebytes, 'Scammers are using fake crypto AML checkers to drain your wallet'","type":"research","credibility":2}],"severity":"high"},{"content":"Multiple sources have catalogued specific domains used in this scam pattern. Malwarebytes' August 2026 report lists amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net, and swapstoken[.]app. PCRisk's two separate removal guides list additional, mostly non-overlapping domains, including amlbot[.]club, amlnix[.]com, aml-safety[.]one, aml-bot.co[.]com, amlbotchecking[.]com, amlbot[.]sale, amlbotchecks[.]com, aml-safety[.]app, amlrobotsaveru[.]com, and amlreport-app[.]com. The crowd-sourced phishing tracker PhishDestroy independently lists dozens of further look-alike domains, such as amlbot.su, amlbot.services, amlbot.run, amlbot.agency, amlbotcoin.com, amltrust.io, aml-checkups.org, and aml-check.cfd, describing several of them as active crypto-drainer phishing sites and others as domains still under investigation with no confirmed drainer kit. Because PhishDestroy entries are community/automated reports rather than vetted research, and because domains of this kind are frequently registered, abandoned, and replaced, this list should be treated as illustrative of the scale of the campaign rather than a complete or stable inventory; individual domains may already be offline.","heading":"Documented fraudulent domains","sources":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Malwarebytes, 'Scammers are using fake crypto AML checkers to drain your wallet'","type":"research","credibility":2},{"url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","name":"PCRisk, 'How to avoid getting scammed by fake \"AMLBot Crypto Checking\" sites'","type":"research","credibility":2},{"url":"https://www.pcrisk.com/removal-guides/32520-fake-amlbot-website-scam","name":"PCRisk, 'Fake AMLBot Website Scam'","type":"research","credibility":2},{"url":"https://phishdestroy.io/fr/domain/amlbotchecks.com/","name":"PhishDestroy, domain report for amlbotchecks.com","type":"community_report","credibility":3},{"url":"https://phishdestroy.io/domain/aml-check.cfd","name":"PhishDestroy, domain report for aml-check.cfd","type":"community_report","credibility":3}],"severity":"high"},{"content":"PCRisk's earlier guide on a fake AMLBot website carries a last-updated date of May 18, 2026, and its later, more detailed guide on the 'AMLBot Crypto Checking Scam' carries a last-updated date of June 2, 2026; neither page states when its first version was originally published, and the June 2026 guide was not further updated through 2026 beyond that date. The June 2026 guide itself contains screenshot and sample files internally dated to 2025, including files referencing June, October, and December 2025, which indicates that variants of this scam technique were circulating at least by mid-to-late 2025, well before Malwarebytes' August 2026 report brought broader attention to it. Decrypt covered the Malwarebytes findings on August 20, 2026. No source reviewed establishes a precise start date for the campaign as a whole, a total number of victims, a dollar figure for losses, or on-chain tracing of funds to specific attacker-controlled wallets; claims to that effect would not be supported by currently available sourcing.","heading":"Timeline and scope of the campaign","sources":[{"url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","name":"PCRisk, 'How to avoid getting scammed by fake \"AMLBot Crypto Checking\" sites'","type":"research","credibility":2},{"url":"https://www.pcrisk.com/removal-guides/32520-fake-amlbot-website-scam","name":"PCRisk, 'Fake AMLBot Website Scam'","type":"research","credibility":2},{"url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","name":"Decrypt, 'Fake Crypto AML Checkers Are Trying to Drain Users' Wallets'","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Malwarebytes advises that a legitimate wallet-screening check only needs a public address and should never require connecting a wallet, approving token access, confirming a transaction, sending crypto, or sharing a recovery phrase or private key; any checker that asks for these should be treated as a warning sign. If a user only connected a wallet to a suspicious site, Malwarebytes recommends disconnecting it. If token access was approved, it recommends reviewing and revoking unrecognized permissions through the wallet provider's approval checker. If a transaction was confirmed or signed unexpectedly, it recommends checking recent wallet activity and moving remaining funds to a new wallet if assets appear at risk. If a recovery phrase or private key was entered, the wallet should be treated as fully compromised and assets moved to a new wallet with a new seed phrase. Malwarebytes also warns that confirmed crypto transactions generally cannot be reversed, so acting quickly matters, and separately cautions that paid 'recovery services' contacting existing victims are frequently themselves scams. AMLBot gives similar guidance specific to its brand: verify that a domain is exactly amlbot.com, never connect a wallet to request an AML check, and never share a seed phrase, noting that it does not charge for unsolicited recovery assistance.","heading":"Recommended protective and recovery steps","sources":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Malwarebytes, 'Scammers are using fake crypto AML checkers to drain your wallet'","type":"research","credibility":2},{"url":"https://blog.amlbot.com/dont-get-tricked-by-fake-amlbot-platforms-protect-your-crypto-from-scammers/","name":"AMLBot blog, 'Don't Get Tricked by Fake AMLBot Platforms'","type":"official","credibility":1}],"severity":"medium"}],"timeline":[{"date":"2025","event":"Variant samples of the fake AMLBot/AML-checker scam template, later catalogued by PCRisk, are internally dated, indicating the technique was already circulating.","source":"PCRisk removal guide (sample files dated 2025-06, 2025-10-07, 2025-12-09, 2025-12-22)","source_url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam"},{"date":"2026-05","event":"PCRisk's guide on a fake AMLBot website scam is last updated, documenting impersonation domains amlbot[.]sale, amlbotchecks[.]com and others.","source":"PCRisk","source_url":"https://www.pcrisk.com/removal-guides/32520-fake-amlbot-website-scam","date_evidence":"May 18, 2026 (updated)"},{"date":"2026-06","event":"PCRisk's more detailed guide on the 'AMLBot Crypto Checking Scam' is last updated, cataloguing further impersonation domains and describing the wallet-drainer mechanism.","source":"PCRisk","source_url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","date_evidence":"June 02, 2026 (updated)"},{"date":"2026-08-19","event":"Malwarebytes publishes a report documenting fake crypto AML-checker sites, listing domains including amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net, and swapstoken[.]app, and describing the approval-signing drainer mechanism.","source":"Malwarebytes","source_url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","date_evidence":"Publication date: August 19, 2026"},{"date":"2026-08","event":"Decrypt covers the Malwarebytes findings on fake crypto AML checkers trying to drain users' wallets.","source":"Decrypt","source_url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","date_original":"2026-08-20"},{"date":"2026-11","event":"AMLBot's own warning post about fake AMLBot platforms shows a listed update date, indicating the company was still tracking impersonation domains at that point.","source":"AMLBot blog","source_url":"https://blog.amlbot.com/dont-get-tricked-by-fake-amlbot-platforms-protect-your-crypto-from-scammers/","date_original":"2026-11-02"}],"sources_used":[{"url":"https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet","name":"Malwarebytes, 'Scammers are using fake crypto AML checkers to drain your wallet'","type":"research","credibility":2},{"url":"https://www.pcrisk.com/removal-guides/33236-amlbot-crypto-checking-scam","name":"PCRisk, 'How to avoid getting scammed by fake \"AMLBot Crypto Checking\" sites'","type":"research","credibility":2},{"url":"https://www.pcrisk.com/removal-guides/32520-fake-amlbot-website-scam","name":"PCRisk, 'Fake AMLBot Website Scam'","type":"research","credibility":2},{"url":"https://blog.amlbot.com/dont-get-tricked-by-fake-amlbot-platforms-protect-your-crypto-from-scammers/","name":"AMLBot blog, 'Don't Get Tricked by Fake AMLBot Platforms'","type":"official","credibility":1},{"url":"https://decrypt.co/376029/fake-crypto-aml-drain-users-wallets","name":"Decrypt, 'Fake Crypto AML Checkers Are Trying to Drain Users' Wallets'","type":"news_article","credibility":2},{"url":"https://phishdestroy.io/fr/domain/amlbotchecks.com/","name":"PhishDestroy, domain report for amlbotchecks.com","type":"community_report","credibility":3},{"url":"https://phishdestroy.io/domain/aml-check.cfd","name":"PhishDestroy, domain report for aml-check.cfd","type":"community_report","credibility":3}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-19T12:22:26.361623+00:00","updated_at":"2026-11-03T09:55:16.74+00:00"},"source_quality":{"total":7,"tier1":0,"tier2":1,"tier3":0,"unrated":6},"follower_count":null,"content_updated_at":"2026-11-03T09:55:17.720Z","last_fact_checked_at":"2026-11-03T09:55:17.062Z","fact_check_next_allowed_at":"2026-11-10T09:55:17.062Z","update_next_allowed_at":"2026-11-10T08:24:45.263Z"}