amlcrypto[.]us

This domain, amlcrypto.us, operates as a fraudulent cryptocurrency payment portal designed to mimic legitimate payment processors. Analysis indicates it presents itself as Cryptomus Pay, a known crypto payment gateway, to deceive users into submitting wallet credentials, private keys, or executing unauthorized transactions. The site employs social engineering tactics, such as fake payment confirmation pages and urgent transfer requests, to exploit victims under the guise of legitimate financial activity. Infrastructure analysis reveals multiple high-confidence indicators of malicious intent. The domain was registered on March 27, 2026, through Web Commerce Communications Limited, a registrar frequently associated with fraudulent sites. It resolves to IP address 172.67.128.183 and is flagged by 13 out of 95 security vendors on VirusTotal. Additionally, it appears on four distinct security blocklists and is actively blocked by multiple browser-based crypto security tools. The site uses Cloudflare for hosting and Let's Encrypt for SSL certification, which, while common, are often leveraged by threat actors to lend a false sense of legitimacy. If you accessed amlcrypto.us or entered any credentials, immediate action is required. Disconnect the device from the network to prevent potential data exfiltration. Revoke any active sessions linked to cryptocurrency wallets or exchanges, and rotate all passwords and private keys associated with crypto accounts. Monitor wallet activity for unauthorized transactions, and report the incident to relevant financial platforms. Users should also scan their systems for malware, as phishing sites may deploy additional payloads. Avoid interacting with any communications or links originating from this domain.