Fake Crypto AML Checker Sites
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
Summary
A widespread wallet-drainer campaign, identified by Malwarebytes researcher Stefan Dasic and independently corroborated by Decrypt, Cryptopolitan, and Security Boulevard in August 2026, operates through counterfeit anti-money laundering (AML) wallet-checking websites. These sites impersonate the legitimate service AMLBot and similar compliance tools, tricking users into connecting their crypto wallets and approving malicious token permissions rather than simply submitting a public address as genuine AML checks require. The same scam kit has been rebranded across numerous domains, indicating a coordinated and ongoing campaign.
Connected Entities
1 entities · 10 linked investigationsTimeline(5 events)
2026-08-19
Malwarebytes researcher Stefan Dasic published a threat-intelligence report documenting the fake crypto AML checker wallet-drainer campaign, identifying the same scam kit operating under multiple rebranded names.
Malwarebytes2026-08-20
Decrypt independently reported on the campaign, corroborating the Malwarebytes findings and noting that multiple fake AML sites were circulating simultaneously.
Decrypt2026-08-20
Cryptopolitan published additional coverage identifying specific fake domains including amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net, and swapstoken[.]app.
Cryptopolitan2026-08-20
Security Boulevard republished the Malwarebytes report, extending distribution of the campaign warning.
Security Boulevard2026-08-27
PCRisk published removal guides for two distinct fake AMLBot site variants, documenting additional fake domains: amlbot.seize[.]report, amlbot[.]sale, amlbotchecks[.]com, aml-safety[.]app, amlbotchecking[.]com, aml-safety[.]one, amlnix[.]com, and amlbot[.]club, among others.
PCRiskDecision Log
- #1publish⛓ pending8/27/2026, 12:20:33 PMhash: aPtnWL1rUPs1zKkTtQAyU6uK2c1rpvhyh8wErpWn759
7 of 9 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/27/2026, 12:20:24 PM
last updated: 8/27/2026, 1:49:08 PM
avoid.net — verified advice for a post-truth world