Is aml-boot.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page service presented as "AML Bot", a Tron USDT AML checker offering TRC20 wallet risk screening for $0.10 per check. It is published on a free subdomain of a general-purpose application-hosting platform rather than on a dedicated domain. Its apparent business model is pay-per-query screening of cryptocurrency wallet addresses for anti-money-laundering risk, aimed at users who move stablecoins on the Tron network.

Scam/Impersonation Risk

The assessment is elevated, and it rests on confirmed adverse reputation rather than on anything the page says about itself. Several independent security engines currently classify the site as malicious, and a few of the most widely relied-upon engines are among them. The site is therefore blacklisted by external threat intelligence. That finding is decisive and cannot be offset by the technical hygiene seen elsewhere. No brand impersonation, conflicting legal identities, or search-safety-list hit was observed, and no wallet-drainer behaviour, clipboard manipulation, hidden forms, cloaking, or credential posts to outside domains were seen in the sandboxed browsing sessions. The risk is a reputation-based one, and the underlying reason for the detections is not itemised in the evidence. A wallet-screening product is also a natural lure. It invites users to submit wallet addresses and pay a small fee on a service whose operator cannot be tied to any real-world entity. During testing, a large share of the page's network activity went to third-party destinations, and several of those destinations are not recognised as standard services. That includes a notable number of outbound POST submissions to unrecognised external endpoints. Where this data goes cannot be established from the evidence. Separately, abuse reports exist against a shared platform IP address, but they relate to the provider's pooled infrastructure, not to this site specifically, and are given no weight here. Evidence:

• Homepage: it presents a $0.10 Tron USDT AML check and TRC20 wallet screening, a payment-linked service with no identifiable operator.
• Reputation checks: multiple security engines flag the site as malicious, and the external blacklist condition is confirmed.
• Homepage behaviour in three successful test runs: 6 non-whitelisted external POST requests (15 external POSTs in total) and 6 non-whitelisted external XHR calls (14 in total), plus 6 console errors.
• Shared-platform abuse reports (90 reports against a content-delivery IP operated by Vercel, Inc) are attributed to shared infrastructure and discounted.

Regulatory Verification Notes

The site gives no verifiable operator identity, licensing status, or registration details, and identity could not be independently connected to any real-world person or company. For a service that positions itself in the compliance and AML screening space, the absence of any named entity or accountable party is a material disclosure gap. It matters less as evidence of a scam than as a reason the service's claims cannot be taken at face value. Nothing in the available evidence shows the site is regulated, and no third-party broker or regulator record matched it. Because the reputation findings carry the verdict, these notes only add that no accountable operator stands behind the output of the screening. Evidence:

• Homepage: no company name, licence, or registration reference was identified in the captured content, and the on-page disclosure position is unclear.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by WR1 at DV (domain-validated) level, valid to 2026-11-27. DV confirms control of the domain only, not the operator's identity.
• Third-party broker dataset: no match for this site.

What to Verify Next

Before any interaction, confirm independently whether a legitimate AML-screening provider operates this service. Look for an official presence under a dedicated, self-owned domain and for a named legal entity, then check that entity in the relevant business or financial-compliance registry. Any claim to provide AML or risk-scoring services should be corroborated through an offline or independently sourced contact route rather than through the site. Wallet addresses should not be submitted and no payment should be made while the malicious classifications remain active. Re-checking the site's reputation after a period would show whether the detections have been cleared. Evidence:

• Homepage: it offers a paid screening service but names no operator to check against a registry.
• Reputation checks: the malicious classifications are current at the time of this assessment.
• Network behaviour: unrecognised external endpoints receive the site's outbound POST requests, so data submitted on the page may leave the site's own domain.

Summary Verdict

The overall posture is high risk. Confirmed adverse reputation from multiple independent sources is decisive, and it outweighs a technically sound transport-encryption setup and otherwise unremarkable sandbox behaviour. The site is not suitable for sensitive, credential-based, or financial interaction.

Infrastructure Integrity

The site resolves to Amazon-operated, Vercel-fronted CDN edge infrastructure, and all observed IPs are edge nodes. The origin server is not observable. This protective layer and a valid certificate from a known issuer are mitigating factors only. They show the site is competently hosted, not that it is safe, and they cannot offset the external threat detections. Edge-only visibility also prevents independent verification of the hosting and can mask rapid content changes.

Closing Assessment

Passive viewing is the only use consistent with the evidence. Login, credential entry, wallet-address submission, and payment should be avoided until the threat classifications are cleared and an accountable operator is independently confirmed.

Signals weighed against the site

• AbuseIPDB: 90 reports on hosting IP 64.29.17.67 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.