app[.]safeaml[.]icu

The domain app.safeaml.icu was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and points to the Cloudflare address 188.114.96.3 (AS13335, United States). No TLS certificate is presented, indicating the site is served over plain HTTP. The site’s title, “AML Check — Мониторинг криптотранзакций”, and the explicit claim that it impersonates AMLBot reveal a targeted brand‑impersonation campaign aimed at cryptocurrency monitoring users. VirusTotal scans show nine of ninety‑five anti‑malware engines flag the domain as malicious, and the domain is listed on one external security blocklist.

PhishDestroy has already taken the domain offline, and the current status is recorded as “offline”. The domain uses the Cloudflare nameservers liberty.ns.cloudflare.com and patrick.ns.cloudflare.com, which are typical for fast‑flux or abused hosting. The observed indicators – recent registration, lack of SSL, Cloudflare hosting, brand‑specific page title, and multiple vendor detections – collectively suggest a crypto‑scam impersonation vector rather than a benign service.

At present, no further HTTP response codes or content snapshots are available, leaving the exact payload or credential‑stealing mechanisms unverified. Defenders should block the domain at perimeter defenses, add the IP 188.114.96.3 to deny‑list tables, and monitor for any DNS queries to the associated Cloudflare nameservers. Continued observation of VirusTotal and other threat‑intel feeds is recommended to capture any post‑remediation activity or re‑hosting attempts.