digitalguard[.]pro

This domain is flagged as a high-risk crypto drainer impersonation targeting cryptocurrency users through fraudulent AML compliance checks. Analysis indicates the site mimics legitimate AML verification services, specifically impersonating AML Bot, to harvest wallet credentials and drain digital assets. The threat type is classified as credential theft with financial asset exfiltration capabilities, posing immediate risk to users engaging with the platform. Infrastructure analysis reveals the domain digitalguard.pro was registered on February 25, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious registrations. It currently resolves to IP address 87.120.219.250, which has been linked to previous phishing campaigns. Detection metrics show minimal coverage, with only 1 out of 95 security vendors on VirusTotal flagging the domain, suggesting either a new or highly evasive campaign. The SSL certificate is issued by Let's Encrypt, providing a false sense of legitimacy while the site remains active and operational. Mitigation steps specific to this crypto drainer threat include immediate blocking of the domain and associated IP at network perimeter devices. Users who may have interacted with the site should revoke all active wallet sessions and transfer assets to new wallets using fresh seed phrases. Organizations should update endpoint detection rules to flag similar AML-themed credential harvesting attempts and monitor for connections to 87.120.219.250. Security teams are advised to conduct retrospective analysis for any prior connections to this infrastructure, particularly from systems involved in cryptocurrency transactions.