aml-free[.]itdeal[.]io

Analysis of aml-free.itdeal.io indicates that the site was used to impersonate LinkedIn in a crypto‑related scam. The domain was registered through NameCheap, Inc. on November 13, 2024 and resolves to the IP address 89.110.97.151, which is allocated to Hosting technology LTD in Russia under ASN 48282. No SSL certificate is presented for the host, and the HTTP service is currently offline. The page title returned during the brief live period was "AML Check - The full-fledged crypto compliance solution," suggesting a fraudulent offering of anti‑money‑laundering services aimed at cryptocurrency users.

The infrastructure is associated with a single security blocklist entry and has been explicitly blocked by PhishDestroy. VirusTotal scans show that one of ninety‑five security vendors flagged the domain, providing an additional indicator of malicious intent. The nameservers dns101.registrar-servers.com and dns102.registrar-servers.com are typical of generic registrar services and do not convey additional trust.

While the exact phishing kit or credential‑harvesting mechanism has not been captured, the convergence of brand impersonation, crypto‑scam framing, and the flagged detection suggests a high likelihood of credential theft or monetary fraud targeting LinkedIn users. Defenders should add aml-free.itdeal.io to URL filtering and DNS blocklists, monitor outbound connections to 89.110.97.151, and consider sinkholing the IP range associated with AS48282. Security teams should also update endpoint detection signatures to include the observed page title and the single vendor detection pattern, and remain vigilant for newly registered domains that reuse the same registrar‑provided nameservers or mimic the "AML Check" phrasing.