aml-c[.]net

PhishDestroy identifies aml-c.net as an active crypto drainer domain posing as a legitimate service to steal cryptocurrency from unwary users. The domain is designed to impersonate legitimate platforms by harvesting wallet credentials and draining funds through unauthorized transactions. Technical analysis indicates the domain is weaponized to trick users into connecting their wallets or entering private keys under false pretenses, resulting in irreversible asset loss. This domain was flagged as a generic phishing site on March 26, 2026, just days after registration, suggesting a fast-turnaround malicious campaign likely leveraging fresh infrastructure to evade detection. This domain resolves to IP address 188.114.96.3 and is registered through TUCOWS.COM, CO., a common registrar used by malicious actors to quickly deploy malicious domains. VirusTotal currently shows 2 out of 95 detection engines flagging the domain, highlighting how new and undetected this threat remains despite active malicious behavior. The domain uses a Let's Encrypt SSL certificate, which provides a false sense of legitimacy to users. Given its recent creation and lack of blocklist presence, this domain represents a high-risk threat with low visibility across security platforms. Users who have visited aml-c.net or entered any wallet-related information should immediately disconnect their wallet from the site, revoke any connected permissions through their wallet interface, and transfer remaining funds to a secure, offline wallet. Scan devices for malware using reputable antivirus tools, enable multi-factor authentication where possible, and avoid reusing passwords. Report the domain to PhishDestroy and monitor wallet transactions for suspicious activity. If funds were stolen, file a report with local cybercrime units and blockchain forensic services. Always verify domains and URLs independently before engaging with cryptocurrency platforms.