tracksaml[.]com

On July 24, 2026, tracksaml.com was identified as an offline domain that previously hosted a page titled "AMLTrack - AML Crypto Risk Checker for BTC, USDT, ETH, and other coins." The site was registered on October 21, 2025 through Hostinger Operations UAB and resolves to the IPv6 address 2a02:4780:9:1728:0:1276:f54b:2, which is associated with AS47583 Hostinger International Limited in Lithuania. No SSL certificate was observed for the domain, indicating that traffic was not protected by HTTPS. The domain’s nameservers are ns1.dns-parking.com and ns2.dns-parking.com, typical of parked or low‑cost hosting services. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of credibility.

The domain appears on two security blocklists and has been actively blocked by PhishDestroy and ScamSniffer. AlienVault OTX references the domain in a single threat‑intel pulse, confirming its inclusion in broader threat‑sharing feeds. VirusTotal analysis recorded detections from two of ninety‑five scanning engines, reinforcing the malicious classification. The listed scam type is "Wallet/Seed Phishing," and the brand target is Telegram, suggesting the infrastructure was intended to harvest cryptocurrency wallet seeds while masquerading as a Telegram‑related service.

While the exact content of the site at the time of takedown is not available, the combination of a cryptocurrency‑focused page title, low trust score, lack of TLS, and association with known phishing blocklists strongly indicates a credential‑stealing operation aimed at Telegram users. Defenders should ensure that tracksaml.com is added to URL filtering and DNS blocklists, monitor for any resurgence of the domain or its IP address, and scrutinize outbound traffic for attempts to contact the associated IPv6 host. Continuous threat‑intel feeds, such as AlienVault OTX and blocklist updates, should be leveraged to maintain awareness of any re‑use of the infrastructure.