amlwallets[.]io

The domain amlwallets.io was registered on October 10, 2024 via NameCheap, Inc. It resolves to IP 67.223.118.62, which is allocated to AS22612 (Namecheap, Inc.) located in the United States. The web server reports LiteSpeed and presents a valid SSL certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36. HTTP response code is 200 and the page title is “AML Wallet”. Scamadviser assigns a trust score of 5/100, indicating a high likelihood of malicious intent. VirusTotal scans show that 10 of 95 security vendors flag the domain as malicious. The domain appears on four security blocklists and is currently blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. The listed scam type is “Crypto Scam”, consistent with the threat classification as a crypto drainer. No additional infrastructure such as extra A records, MX records, or sub‑domains is disclosed. The combination of a low trust score, multiple vendor detections, and active blocklist listings suggests the site is being used to solicit cryptocurrency transfers, likely by impersonating legitimate anti‑money‑laundering services. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for the resolved IP, and consider adding the IP address to threat intelligence feeds. Further investigation of the site’s content, URL paths, and any associated command‑and‑control traffic is required to confirm the exact draining mechanisms.