Fake Crypto AML Checker Drainer Campaign
Last changed 2026-11-03 · Fact-check review — Fact-check review (verdict: approve): the reviewer checked the page's claims against its sources; the judge moved the trust score from 0 to 1. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4STRQx…jDEQSummary
A cluster of phishing websites poses as cryptocurrency wallet anti-money-laundering (AML) screening tools, some impersonating the legitimate service AMLBot and others using generic names such as 'AML Check,' to trick visitors into connecting a wallet and approving a malicious transaction that drains its funds. Malwarebytes documented the pattern in August 2026, AMLBot has separately warned customers about look-alike domains, and malware-removal sites such as PCRisk have catalogued dozens of related fraudulent domains since at least mid-2025. No single operator, loss total, or on-chain trace of stolen funds has been publicly confirmed; the entity here is a recurring scam technique and domain cluster rather than one identified company or person.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(6 events)
2025
Variant samples of the fake AMLBot/AML-checker scam template, later catalogued by PCRisk, are internally dated, indicating the technique was already circulating.
PCRisk removal guide (sample files dated 2025-06, 2025-10-07, 2025-12-09, 2025-12-22)May 2026
PCRisk's guide on a fake AMLBot website scam is last updated, documenting impersonation domains amlbot[.]sale, amlbotchecks[.]com and others.
PCRiskJune 2026
PCRisk's more detailed guide on the 'AMLBot Crypto Checking Scam' is last updated, cataloguing further impersonation domains and describing the wallet-drainer mechanism.
PCRisk19 August 2026
Malwarebytes publishes a report documenting fake crypto AML-checker sites, listing domains including amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net, and swapstoken[.]app, and describing the approval-signing drainer mechanism.
MalwarebytesAugust 2026
Decrypt covers the Malwarebytes findings on fake crypto AML checkers trying to drain users' wallets.
DecryptNovember 2026
AMLBot's own warning post about fake AMLBot platforms shows a listed update date, indicating the company was still tracking impersonation domains at that point.
AMLBot blogDecision Log
- slot 464856035 · hash 7ePpo9wvCT5SDRsti2GJdx5LhgDjkgLkw6ZgyBS9nrvJ
- slot 464856029 · hash Eagdfc4MVexxW2QA7RwakGcnXD7aNcyxtyAzVasNJJg1
- slot 462038095 · hash A1s85yFpGVnmeWTwH828je4fpTiPpETYYNJVesn5Rugw
- slot 462038089 · hash 4xA9imx3SdHrMJLmpKFnxZAqifreuAMeE3ztyvbvsLTH
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 0 of 7 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 9/19/2026, 12:22:26 PM
last updated: 11/3/2026, 9:55:17 AM
2 viewsavoid.net — verified advice for a post-truth world