amlfree[.]xyz

On July 24 2026, amlfree.xyz was identified as a brand‑impersonation infrastructure targeting Binance users. The domain was registered on June 25 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv4 address 213.176.66.26, which is allocated to AS210644 AEZA GROUP LLC and geolocated to Germany. No SSL certificate was presented when the site was reachable, indicating that communications were not protected by HTTPS. The page title returned by the server reads “AML Проверка Криптокошельков Онлайн | AML Бот для Борьбы с Отмыванием Денег”, a Russian‑language phrase describing an AML verification bot, consistent with the reported crypto‑scam classification. Detection services have flagged the domain.

Three of ninety‑five antivirus engines on VirusTotal returned a positive classification, and two independent blocklists—PhishDestroy and ScamSniffer—have listed the domain. The Gridinsoft trust score is recorded as 0 out of 100, reinforcing the malicious assessment. The nameserver configuration uses NS1.SUSPENDED-DOMAIN.COM and NS2.SUSPENDED-DOMAIN.COM (both also listed in lowercase form), which are commonly associated with abandoned or compromised domains. The current HTTP status is offline, preventing live verification of the content, and no TLS certificate can be inspected. Consequently, the precise content of the landing page, including any credential‑capture forms or malicious scripts, remains unknown.

However, the combination of brand impersonation of Binance, the Russian AML‑related title, and the classification as a crypto scam strongly suggests an attempt to lure cryptocurrency users into submitting wallet credentials or transferring funds. Defenders should block DNS resolution for amlfree.xyz, add the associated IP address 213.176.66.26 to network deny lists, and ensure that endpoint security solutions are updated to reflect the three VirusTotal detections.