aml-wallet[.]help

The domain aml-wallet.help was a crypto drainer phishing site designed to steal cryptocurrency by tricking users into connecting their wallets. Unlike typical brand impersonation, this site operated without mimicking a specific company or using a known drainer kit. As of the latest verification, aml-wallet.help has been taken offline, though its prior activity posed an elevated risk to users who may have interacted with it.

Technical analysis shows that aml-wallet.help was flagged by 2 of 95 VirusTotal security vendors, including Ermes and Gridinsoft, while appearing on 1 security blocklist (PhishDestroy). The domain was created on February 21, 2026, and resolved to the IP address 2.59.163.70, hosted in Poland under AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP). The SSL certificate was issued by R12, and the observed page title was 'Crypto Wallet Verification'. Google Safe Browsing did not flag the domain at the time of assessment.

Users who connected a wallet to aml-wallet.help should immediately revoke all token approvals using a tool like revoke.cash or Etherscan's token approval checker. Funds should be transferred to a new wallet to prevent further unauthorized transactions. Victims are advised to report the domain to their wallet provider and file complaints with relevant authorities, such as the FBI's IC3 (for U.S. residents) or local cybercrime units. Monitoring account activity for suspicious transactions is also recommended.