amlbuilds[.]com

The domain amlbuilds.com was a brand-impersonation phishing site targeting users through cryptocurrency scams. It posed as 'foundation', a legitimate entity, but did not employ a known drainer kit. The site has since been taken offline, though it previously operated as an active phishing threat.

Technical indicators show amlbuilds.com was flagged by 1 of 95 VirusTotal security vendors, including Gridinsoft, which assigned a trust score of 0/100. It appeared on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. The domain was registered through Network Solutions, LLC on February 21, 2026, and resolved to the IP address 209.17.116.160, hosted by Network Solutions, LLC (AS19871) in the US. The SSL certificate was issued by Network Solutions L.L.C. under the Network Solutions RSA DV SSL CA 3. Detected technologies included Nginx, OpenResty, jsDelivr, and HSTS. The observed page title was 'AML Contractors | Pittsburgh Construction & Remodeling', though the site impersonated 'foundation' for cryptocurrency-related fraud.

Victims of amlbuilds.com should immediately revoke any token approvals granted to suspicious contracts and transfer remaining funds to a new cryptocurrency wallet. Monitor accounts for unauthorized transactions and enable two-factor authentication (2FA) on all financial and email platforms. Report the domain to relevant authorities, including local cybercrime units, the FTC at reportfraud.ftc.gov, and the impersonated brand's official fraud reporting channels. Additionally, submit the domain to Google Safe Browsing and other threat-intelligence platforms to prevent further abuse.