aml[.]swapx[.]fun

PhishDestroy has identified aml.swapx.fun as a crypto drainer phishing domain, specifically designed to impersonate AML verification processes to steal cryptocurrency assets. This domain is now offline, but its recent activity posed a significant threat to users seeking financial compliance services. The domain was registered through HOSTINGER operations, UAB, on May 17, 2026, and resolved to IP address 64.118.157.72, which may still host other malicious content.

Technical analysis shows that the domain was flagged by 1 of 95 VirusTotal security vendors, indicating a low but present detection rate among automated scanners. It appears on 1 security blocklist, suggesting limited but targeted recognition by the cybersecurity community. The domain lacks an SSL certificate, which is a clear red flag for any site handling sensitive data like crypto wallet credentials. The page title, "AML Verification," was crafted to lure victims into believing they were interacting with a legitimate compliance service, when in reality the goal was credential theft and crypto drainer functionality.

The risk level is elevated due to the specificity of the social engineering and the potential for financial loss. Although the domain is currently offline, users should remain vigilant. PhishDestroy recommends avoiding any domain that impersonates AML or KYC processes without verified SSL certificates and proper registration history. If you have entered any credentials or connected a wallet to this domain, immediately transfer your funds to a new, secure wallet and enable two-factor authentication. Regularly monitor your accounts for unauthorized transactions and report any suspicious activity to your financial institution.