aml-safety[.]one

The domain aml-safety.one was created on February 21, 2026 and is currently taken offline. Infrastructure analysis shows the domain resolves to IP 216.126.229.237, which belongs to ASN AS30823 operated by aurologic GmbH in Germany. Registration was performed through Dynadot LLC, and the authoritative name servers are ns1.dyna-ns.net and ns2.dyna-ns.net. No SSL certificate is present, indicating the site was served over plain HTTP.

The page title observed during the brief live probe was "AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check," suggesting the site was masquerading as a compliance‑related service. The threat is classified as an Investment Scam, and the risk level is elevated. Detection evidence includes placement on two security blocklists—PhishDestroy and ScamSniffer—and a VirusTotal scan that yielded 2 positive detections out of 95 security vendors. No additional malware kits, brand impersonations, or post‑compromise payloads were identified.

Uncertainty remains regarding the exact phishing workflow, the presence of credential‑stealing forms, and any active command‑and‑control infrastructure, as the site has been taken offline and no further content was captured. Defensive recommendations are to block the domain and its resolved IP at network perimeters, add the domain to URL filtering and DNS threat‑intel feeds, monitor for any DNS queries to the associated name servers, and consider sinkholing the IP address if the hosting provider permits. Continuous re‑evaluation is advised in case the domain is re‑registered or the infrastructure is reused for related campaigns.