Brand Impersonation Evidence: AMLBot

Lookalike domains are impersonating AMLBot

This is a public evidence page from Scam Detective’s published research. The real AMLBot operates at amlbot.com. The 3 domains below impersonate it — each with the corroborated evidence. Nothing here is a guess: every finding is backed by the independent sources listed further down the page.

Lookalike domains found

Critical

Overall risk level

Independent corroborating sources

October 17, 2026

Case verified

The evidence

Confirmed lookalike domains

Critical riskFake AML checker — impersonates the real AMLBot

safe-multi.app

Registration profileNewly registered .app domain in a rotating cluster — the operators keep registering fresh domains as each one accumulates vendor detections

First seenOctober 2026, surfacing in Reddit scam reports within 24 hours of observation

Evidence

Poses as an anti-money-laundering checker where you supposedly verify whether your crypto wallet or funds are “clean” — it is not a real AML service.
The “check” always returns high-risk: the flag is fabricated so the site's support team can demand fees to “cleanse” the funds and clear it.
IPQualityScore has reported the domain for phishing, and ScamAdviser rates it “Caution Recommended.”
Often reached through an “exchange support agent” or “account manager” insisting you verify your funds before a withdrawal — the check manufactures the problem the fee solves.
The fee loop: the first fee doesn't clear the flag, a “deeper issue” is found, a second fee follows — and when you stop paying, the support agent and the site both go quiet.

High riskFake AML checker — sibling domain in the impersonation cluster

multiscan.app

Registration profileSame rotating cluster — registered as a sibling burner domain with the same borrowed branding

First seenOctober 2026, documented as part of the cluster

Evidence

Carries 15 security-engine detections out of 91 on VirusTotal and is listed by Spamhaus.
Same borrowed AMLBot branding and the same always-flag-then-fee play as the rest of the cluster.

High riskFake AML checker — sibling domain in the impersonation cluster

aml-transactions.app

Registration profileSame rotating cluster — the page's title literally reads “AMLBot”, copied straight from the real company it's impersonating

First seenOctober 2026, documented as part of the cluster

Evidence

ScamAdviser scores it 1 out of 100.
Its page title literally reads “AMLBot” — copied straight from the real company it is impersonating.
Security vendors have independently converged on every domain in the set — which is exactly why the cluster keeps registering new ones.

Red flags in this impersonation

01A check that always flags you high-risk — real AML risk reports are probabilistic and often boring; a checker whose output is always “flagged” is a fee generator with a report skin.

02Fees to fix a risk score — no legitimate AML provider sells “cleansing.” Compliance services assess risk; they do not launder, clean, unflag, or release funds.

03A borrowed name — the cluster's pages title themselves “AMLBot.” Verify you're on the real company's own domain by typing it yourself, never via a link.

04You reached the checker through a link someone sent you — a real compliance tool doesn't arrive via an “account manager” or “support agent.”

05Vendor reports already in — phishing reports and 1/100 trust scores on the cluster's domains.

06Newly registered domains in a rotating cluster.

Who corroborates this evidence

VirusTotal and Spamhaus

multiscan.app carries 15 security-engine detections out of 91 on VirusTotal and is listed by Spamhaus.

ScamAdviser

Scores aml-transactions.app at 1 out of 100 and rates safe-multi.app “Caution Recommended.”

IPQualityScore

Has reported safe-multi.app for phishing.

Reddit scam reports

The cluster surfaced in victim reports within 24 hours of observation.

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29

Get the free AMLBot impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.