aml-safety[.]app

Analysis of the domain aml-safety.app indicates it was actively involved in an investment scam phishing campaign as of July 23, 2026. The domain, registered through Dynadot LLC on February 21, 2026, resolved to the IP address 216.126.229.237, hosted under AS30823 (aurologic GmbH) in Germany. No SSL certificate was present, increasing the risk of unencrypted data interception. The domain's nameservers, ns1.dyna-ns.net and ns2.dyna-ns.net, further link it to a hosting infrastructure commonly associated with malicious activity.

At the time of assessment, the domain was flagged by four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, and was classified as an investment scam. VirusTotal detections were limited, with only 3 of 93 security vendors marking it as malicious, suggesting either a targeted campaign or a relatively new threat at the time of scanning. The page title, 'AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check,' implies an attempt to impersonate a legitimate cryptocurrency compliance service, though no direct evidence of the targeted brand's involvement or endorsement is present in the available data.

The domain has since been taken offline, but defenders should remain vigilant for similar domains registered through the same registrar or resolving to the identified IP range. Network administrators are advised to block the IP 216.126.229.237 and monitor for domains using the dyna-ns.net nameservers, as these may indicate ongoing or future phishing infrastructure. The absence of SSL and the domain's rapid inclusion on multiple blocklists underscore the elevated risk associated with this campaign.