amldefi[.]com

This domain, amldefi.com, has been confirmed as a crypto drainer phishing site designed to siphon cryptocurrency assets from unsuspecting victims. Analysis indicates the site is currently offline, though its infrastructure remains a potential threat vector for future malicious activity. The primary objective of this campaign appears to be the unauthorized transfer of digital assets by exploiting wallet connections or deceiving users into authorizing fraudulent transactions. Infrastructure analysis reveals that amldefi.com was registered on March 15, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The domain resolves to the IP address 146.148.222.179, which has been linked to other suspicious activities. At the time of assessment, the domain was flagged by 3 of 95 security vendors on VirusTotal, indicating limited but targeted detection. Additionally, the domain appears on one security blocklist, further corroborating its malicious nature. No legitimate brand association was identified, distinguishing this as a standalone crypto drainer operation rather than a brand impersonation scheme. As of the latest verification, amldefi.com has been taken offline, likely in response to detection and mitigation efforts. However, the risk of re-emergence or domain repurposing remains elevated. Users are strongly advised to revoke any wallet authorizations associated with this domain and scrutinize transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address, while monitoring for similar newly registered domains under the same registrar. Cryptocurrency holders are reminded to verify domain authenticity and employ hardware wallets or isolated environments for high-value transactions to mitigate exposure to such threats.