amlcrypto[.]io

The domain amlcrypto.io is currently active and classified as a high‑risk AML‑scam phishing site. It presents a page titled “Tools for analyzing blockchain transactions and investigating crypto incidents” in an attempt to lure cryptocurrency users into disclosing personal or financial information. The site returned HTTP 200, indicating a fully functional web server. Infrastructure analysis shows the domain is hosted on IP 185.215.4.19, which resolves to a server located in Russia and associated with the Tildapublishing network. Authority records list Linda.ns.cloudflare.com and Kareem.ns.cloudflare.com as the authoritative nameservers, confirming the use of Cloudflare’s DNS service. The domain is registered through GoDaddy.com, LLC on June 11 2026, and uses a Let’s Encrypt R12 certificate for TLS encryption. Mail exchange is delegated to mx.yandex.net (priority 10), suggesting reliance on Yandex’s mail infrastructure. Threat intelligence feeds reinforce the malicious assessment. AlienVault OTX lists the domain in four separate pulses, and PhishDestroy has actively blocked it. The site appears on one public security blocklist, while Gridinsoft’s trust scoring system assigns a score of 0 out of 100, indicating extreme suspicion. VirusTotal reports that two out of ninety‑five security vendors flagged the domain, providing additional confirmation of its malicious nature. Open questions remain regarding the operators behind amlcrypto.io, as no ASN or specific toolkits have been disclosed. Defenders should prioritize immediate blocking of the domain at network perimeter and email gateways, and enforce URL filtering for the associated IP address. Continuous monitoring of the Cloudflare nameservers and the Yandex MX record is advised to detect any rapid redeployment. Users should be warned about the AML‑scam lure and instructed to verify any unsolicited requests for blockchain analysis tools through trusted channels.