amlcryptoscan[.]tw

This domain, amlcryptoscan.tw, is flagged as a crypto wallet phishing site targeting users of Bitcoin (BTC), Tether (USDT), Ethereum (ETH), and TON coin. Analysis indicates the site impersonates an anti-money laundering (AML) risk-checking tool, likely designed to harvest wallet credentials or private keys under the guise of transaction verification. No specific drainer kit signatures were identified, but the generic phishing classification suggests broad-spectrum credential theft targeting cryptocurrency holders. Infrastructure analysis reveals the domain was registered through Epag.de on March 24, 2026, an unusually future-dated creation that may indicate automated or bulk registration tactics. It resolves to the IP address 45.89.60.114, hosted on an Ubuntu server running Nginx with Unpkg dependencies. Detection metrics show 6 out of 95 security vendors on VirusTotal flagged the domain, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was previously blocked by PhishDestroy. Google Safe Browsing (GSB) status is not explicitly confirmed in available data. The domain is currently offline, though its prior hosting infrastructure and registration details remain accessible. Response actions should include monitoring for re-registration or IP reassignment, as the threat actor may attempt to revive the campaign under a new domain or hosting provider. Users who interacted with the site should assume credential compromise and take immediate steps to secure their wallets, including revoking active sessions, transferring funds to new addresses, and enabling multi-factor authentication where applicable. The elevated risk level persists due to the domain's recent activity and the high-value target profile of cryptocurrency users.