amle[.]us

The domain amle.us is currently under investigation for credential theft, specifically targeting entities within the nonprofit and legal advocacy sectors. Analysis indicates the site was designed to impersonate the American Muslim Legal Ecosystem (AMLE), a legitimate organization, to harvest login credentials and sensitive donor information. As of the latest assessment, the domain has been taken offline, though prior activity suggests a coordinated effort to exploit trust in nonprofit branding. Infrastructure analysis reveals the domain was registered on July 22, 2025, through GoDaddy.com, LLC, and resolved to the IP address 35.219.200.5, hosted on Google Cloud infrastructure. Despite zero detections from 95 VirusTotal vendors, the domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, indicating high-risk classification. Technologies detected include Node.js, React, Next.js, and reCAPTCHA, which may have been leveraged to create a seemingly legitimate interface while masking malicious backend operations. The SSL certificate is issued by Google Trust Services, a common tactic to evade initial suspicion. Current status confirms the domain is offline, though residual risks remain for users who may have interacted with it prior to takedown. Organizations in the nonprofit and legal advocacy sectors are advised to audit recent login attempts, reset credentials for any accounts associated with amle.us, and monitor for unauthorized access. Network administrators should block the IP address 35.219.200.5 and implement domain-based filtering to prevent future exposure. Users should verify the legitimacy of any communication claiming affiliation with AMLE by cross-referencing official contact channels. Proactive threat hunting for indicators such as the domain registration date, hosting provider, and detected technologies is recommended to identify potential lateral movement or secondary attack vectors.