amlranger[.]ai

The domain amlranger.ai is a confirmed phishing site engaged in brand impersonation targeting Revolut users. It operates as a cryptocurrency scam, designed to deceive victims into disclosing sensitive financial information or transferring digital assets under false pretenses. As of the latest verification, amlranger.ai has been taken offline, though its prior activity remains a documented threat.

Technical analysis reveals that amlranger.ai was registered through Key-Systems GmbH on 2025-07-23 07:37:29 and resolved to the IP address 104.21.44.42, hosted on Cloudflare's infrastructure in the US. Security scans showed 0 of 95 VirusTotal vendors flagged the domain, and Google Safe Browsing did not list it as malicious. However, it appeared on 1 security blocklist (PhishDestroy). The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Mini-ON Your Virtual Compliance Team'. Detected technologies included LinkedIn Insight Tag, Hyros, Google Tag Manager, Google Analytics, Facebook Pixel, CookieYes, and Cloudflare Browser Insights.

Individuals who interacted with amlranger.ai should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new cryptocurrency wallet. Monitor Revolut accounts for unauthorized transactions and enable two-factor authentication if not already active. Report the domain to Revolut's security team and submit it to platforms like PhishTank or the Anti-Phishing Working Group to aid in broader threat mitigation.