# aml-safe.one — MALICIOUS

> aml-safe.one is a confirmed phishing site impersonating Bybit. Avoid this domain to protect your credentials and assets from theft.

## Summary
PhishDestroy identifies aml-safe.one as a high-risk phishing domain targeting Bybit users. This site posed a danger by mimicking Bybit’s brand to deceive victims into trusting it.

The phishing scheme involved presenting a fake Bybit copytrading service, tricking users into copying trades and sharing sensitive information. It exploited trust in the Bybit brand to harvest login credentials and potentially compromise accounts.

If you visited aml-safe.one, immediately change your Bybit account password and enable two-factor authentication. Monitor your accounts for unauthorized activity and report suspicious incidents to Bybit support.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 0)
- Scam type: AML Scam
- Target brand: Bybit
- Page title: Bybit Copytrading - Копируй сделки и зарабатывай каждый день

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Dynadot LLC
- Country: US
- IP: 104.194.157.88
- IP Country: DE
- IP City: Frankfurt am Main
- IP Org: AS14956 RouterHosting LLC
- Nameservers: ["ns1.dyna-ns.net", "ns2.dyna-ns.net"]
- SSL Issuer: none

## Detection Status
- VirusTotal: 11 vendors flagged
  Vendors: ["alphaMountain.ai", "Certego", "CyRadar", "Emsisoft", "Forcepoint ThreatSeeker", "Fortinet", "Gridinsoft", "Netcraft", "Seclookup", "SOCRadar", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019c57de-8f23-75be-8c9b-a8a872488012.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/2095a766-d124-4fd6-a6d1-b3f62d4ab4d8
- PhishDestroy: https://phishdestroy.io/domain/aml-safe.one/
- LLM endpoint: https://phishdestroy.io/domain/aml-safe.one/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/aml-safe.one/
Last updated: 2026-03-19