Fake Crypto AML Checker Sites
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·wR9Anc…uwo8Summary
A widespread wallet-drainer campaign, identified by Malwarebytes researcher Stefan Dasic and independently corroborated by Decrypt, Cryptopolitan, and Security Boulevard in August 2026, operates through counterfeit anti-money laundering (AML) wallet-checking websites. These sites impersonate the legitimate service AMLBot and similar compliance tools, tricking users into connecting their crypto wallets and approving malicious token permissions rather than simply submitting a public address as genuine AML checks require. The same scam kit has been rebranded across numerous domains, indicating a coordinated and ongoing campaign.
Connected Entities
2 entities · 4 linked investigations- Fake Crypto AML Checker Sites→mentioned with→CoinDCX(60%)
Connected Through
1 shared actor · 4 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦CoinDCXtoken
Timeline(5 events)
19 August 2026
Malwarebytes researcher Stefan Dasic published a threat-intelligence report documenting the fake crypto AML checker wallet-drainer campaign, identifying the same scam kit operating under multiple rebranded names.
Malwarebytes20 August 2026
Decrypt independently reported on the campaign, corroborating the Malwarebytes findings and noting that multiple fake AML sites were circulating simultaneously.
Decrypt20 August 2026
Cryptopolitan published additional coverage identifying specific fake domains including amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net, and swapstoken[.]app.
Cryptopolitan20 August 2026
Security Boulevard republished the Malwarebytes report, extending distribution of the campaign warning.
Security Boulevard27 August 2026
PCRisk published removal guides for two distinct fake AMLBot site variants, documenting additional fake domains: amlbot.seize[.]report, amlbot[.]sale, amlbotchecks[.]com, aml-safety[.]app, amlbotchecking[.]com, aml-safety[.]one, amlnix[.]com, and amlbot[.]club, among others.
PCRiskDecision Log
- slot 443525995 · hash aPtnWL1rUPs1zKkTtQAyU6uK2c1rpvhyh8wErpWn759
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 7 of 9 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/27/2026, 12:20:24 PM
last updated: 8/27/2026, 12:20:25 PM
3 viewsavoid.net — verified advice for a post-truth world