Is aml-scan-risk.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents itself as an anti-money-laundering verification service for the TRON TRC20 ecosystem. Its page title advertises a wallet risk score and sanctions screening, so its apparent purpose is to let visitors submit blockchain wallet details and receive a compliance-style risk assessment. It runs as a single-page front end on a free-tier subdomain of a general-purpose web hosting platform, not on a dedicated branded domain.

Scam/Impersonation Risk

This is the decisive section of the report. Several independent security engines, including multiple tier-one vendors, currently classify the domain as malicious. The reputation evidence is strong enough that the domain is blacklisted by external threat-intelligence sources. The domain was registered only days before the assessment, and its archive history is minimal. A service that sells trust (sanctions screening and wallet risk scoring) from a brand-new, flagged domain is a recognised lure pattern. Visitors who are worried about compliance exposure are the people most likely to paste wallet addresses or follow prompts without scrutiny. In the homepage's runtime behaviour, the page made a high proportion of its requests to external destinations. These included a notable number of external background requests and external POST submissions, some of them to destinations outside the commonly recognised set. That is consistent with data leaving the page to third parties during normal use. The sandbox did not observe wallet-connection prompts, clipboard tampering, hidden forms, credential forms posting off-site, or content cloaking. These are mitigating observations, but they do not outweigh the external detections. No conflicting legal identities or confirmed brand impersonation were observed on the pages analysed. Evidence:

• Homepage and domain provenance: the domain was registered in 2026 and is roughly 9 days old.
• Web archive: 2 snapshots, both captured on 2026-10-12, with a tracked history of about 1 year.
• Homepage runtime behaviour: 13 external background requests and 14 external POST submissions across 3 sandbox runs, with about 3 of each going to non-whitelisted destinations. The page also logged 3 console errors.
• Homepage security reputation: flagged as malicious by multiple security engines, including three tier-one vendors, and independently confirmed as blacklisted.

Regulatory Verification Notes

The site operates in a domain where legitimacy is normally anchored in an identifiable, registered operator: AML screening and sanctions checks. No independent regulatory registration could be matched, and no third-party broker-reputation record exists for the site. The operator's real-world identity could not be connected to any known company or person. Ownership details are incomplete, and this is treated as ownership opacity, not as an identity contradiction. The lack of regulatory standing is a verification gap, not proof of wrongdoing, but here it compounds the confirmed reputation problem instead of offsetting it. The transport encryption is valid. It is a basic domain-validated certificate, which shows only that the connection is encrypted and does not show who operates the site. Evidence:

• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US) in the US.
• Transport encryption: TLS certificate issued by WR1 at DV validation level, valid to 2026-11-27 (36 days remaining).
• Regulatory and broker records: no matching regulatory registration or broker-reputation entry.
• Homepage: the page captured successfully with substantial text content. No verified link between the site and a real-world brand or operator could be established.

What to Verify Next

Any organisation claiming to operate this screening service should be asked to confirm, through its own established and independently sourced channels, whether this property belongs to it. The claimed operator's licensing or registration should be checked directly with the relevant financial-intelligence or registry authority, using details obtained independently of this site. Blockchain addresses of real interest should be screened only through providers whose identity and regulatory standing are already established. Re-testing after the operator or hosting platform remediates the flagged content would show whether the malicious classification has cleared. Evidence:

• Homepage: the service's claim to provide TRON TRC20 wallet risk scoring and sanctions screening cannot be tied to an identifiable operator.
• Domain provenance: the very recent registration gives no track record on which to rest trust.
• Outbound traffic: the non-whitelisted external POST destinations observed in the sandbox have not been attributed to any known service.

Summary Verdict

The overall posture is high-risk. Converging external threat detections and a confirmed blacklisting, together with a very young domain and an unverifiable operator, override the technically sound transport security and the absence of observed wallet-drainer or cloaking behaviour. The available evidence does not support treating this website as a legitimate compliance or screening service.

Infrastructure Integrity

The site is delivered through a managed web platform and CDN on Amazon-operated cloud infrastructure, and every observed address is an edge node, so no origin server was visible. Edge-only visibility prevents independent hosting verification and can mask rapid content swaps. The platform's protections are a mitigating factor only and cannot offset the reputation risk. A large number of abuse reports are attached to one of the edge addresses. They apply to a shared provider address used by many unrelated sites and are therefore discounted, but they are not independent evidence in this site's favour.

Closing Assessment

The site should not be used for login, credential entry, wallet-address submission, or any financial interaction. Passive viewing is the outer limit of acceptable use, and nothing should be downloaded from it. Anyone who has already submitted information to it should treat that data as exposed and monitor the related accounts and wallets.

Signals weighed against the site

• AbuseIPDB: 84 reports on hosting IP 216.198.79.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.