safeaml[.]net

Analysis of safeaml.net indicates a deliberately crafted crypto‑related impersonation campaign targeting Binance users. The domain was registered through NameCheap, Inc. on 30 June 2025 and resolves to the Amazon‑owned address 64.29.17.65, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. The site presented the page title “AMLBot – The full‑fledged crypto compliance solution,” a phrasing that aligns with the declared scam type of a crypto scam and the brand target “binance.” The SSL certificate is identified as rating R10, offering minimal trust, and the Gridinsoft trust score is 0 / 100, indicating an extremely low reputation. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service.

VirusTotal analysis shows that two of ninety‑three scanned vendors flagged the domain, confirming malicious intent despite the low detection count. The infrastructure suggests the operator leveraged inexpensive domain registration and a reputable cloud provider to host a phishing front‑end that masquerades as a compliance solution, likely to harvest credentials or funds from Binance users. The current status is listed as offline, preventing direct verification of page content, forms, or redirects. Consequently, the precise tactics, techniques, and procedures employed on the live site remain unobserved.

Defenders should immediately add safeaml.net to network and endpoint blocklists, monitor outbound connections to 64.29.17.65, and enforce DNS filtering for the domain. Continuous observation of the associated IP range owned by Amazon is advised, as the actor may redeploy the campaign under new subdomains. Given the elevated risk rating and the confirmed brand impersonation, organizations handling Binance‑related assets should treat any communication referencing AMLBot or similar compliance language with heightened suspicion.