Fake AML Checkers: How Wallet Drainers Pose as AML Bots

How the scam works

Security firm Malwarebytes described fake AML-checker sites that imitate known brands, show a fake “checking wallet history” progress bar, ask visitors to connect a wallet and then present a transaction to approve or sign that authorises transfers of their funds.^[1] It is a variant of approval phishing, where victims are tricked into granting a scammer permission to spend tokens in their wallet; Chainalysis documented a fake “approval checker” page that worked the same way.^[2]

Warning signs

• The site asks you to connect a wallet or approve / sign anything.
• It asks for a seed phrase or private key “to verify ownership”.
• The domain adds words to a known brand (for example, a brand name plus “-clear” or “-aml”).
• You arrived from an ad, a DM or a “support agent”, not from the service’s official site.

Domains already reported

Malwarebytes named, among others: amlbot-clear[.]com, audittrust[.]shop, bitget-aml[.]com, search-aml[.]net and swapstoken[.]app (written with [.] so they are not clickable). New ones appear constantly — the pattern matters more than the list.

We keep a live list of fake AML checkers, rebuilt every 3 days from the phishing lists that wallets use.

Use the official links

Open the service’s website yourself and follow its own link to the bot or app. We list official Telegram handles as linked from each service’s site.

If you already approved something

1. Move remaining funds to a new wallet with a new seed phrase immediately.
2. Revoke token approvals in your wallet’s own approvals screen, or on the token-approval page of the network’s official block explorer (for example Etherscan’s Token Approval Checker), typing the address yourself. Never use a “revoke” tool from an ad, a direct message or a “support agent” — fake revoke sites are a common second scam.
3. Report the site to your wallet provider and the impersonated brand, and keep the transaction IDs.
4. Ignore “recovery” offers — they are a second scam.