crypto-aml[.]help

PhishDestroy identifies crypto-aml.help as a newly active phishing domain posing as an Anti-Money Laundering (AML) compliance portal for cryptocurrency businesses. The domain is currently under investigation for generic phishing activities, with no confirmed brand impersonation at this stage. As of July 10, 2025, the domain remains active and presents an emerging threat to cryptocurrency firms seeking legitimate AML services. This domain was flagged by 7 of 95 VirusTotal vendors, indicating it has yet to be widely recognized as malicious despite its suspicious characteristics. Registered through Web Commerce Communications Ltd, crypto-aml.help resolves to IP address 104.21.23.63 and holds a valid SSL certificate issued by Google Trust Services. The domain’s recent creation date (July 10, 2025) and clean VirusTotal score suggest it may be a newly deployed threat actor resource. No blocklist entries or trust score penalties have been recorded for this domain at this time. The current status of crypto-aml.help is active and under investigation, with no immediate escalation to blocklisting observed. Users and organizations in the cryptocurrency sector are advised to exercise extreme caution when encountering this domain. Concrete recommendations include: avoid clicking on any links or downloading files from crypto-aml.help, verify the legitimacy of AML service providers through official channels, report the domain to cybersecurity teams or abuse contacts, and update network blocklists to include this domain and associated IP. Continuous monitoring of this domain is strongly recommended due to the potential for rapid escalation as additional threat intelligence emerges.