check[.]safeaml[.]icu

On 24 July 2026, check.safeaml.icu was observed as an offline site associated with a brand‑impersonation investment scam. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses Cloudflare’s DNS with the authoritative nameservers liberty.ns.cloudflare.com and patrick.ns.cloudflare.com. DNS resolution returns the IPv6 address 2a06:98c1:3120::3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. No TLS certificate was presented when the site was reachable, indicating the lack of HTTPS protection.

The page title returned by the server reads "AML Check — Мониторинг криптотранзакций", suggesting a focus on cryptocurrency transaction monitoring, consistent with the reported scam type of "Investment Scam". VirusTotal records show that nine of ninety‑five scanning engines flagged the domain, and the site appears on a single external blocklist. PhishDestroy has also listed the domain as blocked. The risk rating assigned by the reporting system is elevated.

Current evidence does not reveal any active payload, credential‑harvesting form, or redirection chain, and the site’s HTTP response code is not available because the service is offline. Analysts should continue to monitor the domain for re‑activation, enforce blocking at network perimeter and endpoint security solutions, and consider adding the IPv6 address to threat‑intel feeds. Further investigation of any future HTTP responses, TLS fingerprints, or associated malware would be required to fully characterize the malicious infrastructure.