Is aml-sec.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

AMLSec presents itself as an institutional blockchain anti-money-laundering intelligence and forensic analytics platform focused on the TRON network. It is published as a subdomain on a shared application-hosting platform. Its homepage is a text-heavy marketing page that frames the service as compliance and investigative tooling, apparently aimed at professional and institutional users.

Scam/Impersonation Risk

Contradictory signals are present and decisive. Several major security vendors independently flag the site as malicious, and a confirmed blacklist listing exists, so the external reputation picture is clearly adverse. A compliance and forensics brand would normally be expected to carry strong reputational standing, so this combination is a pronounced mismatch. A credible AML brand would also be unlikely to launch on a free shared-platform subdomain. The site's browser behaviour adds corroboration. During interaction, almost all observed network traffic went to external destinations, and a notable share of it went to non-allowlisted third parties. That includes several outbound data submissions to parties outside the site's own domain. No wallet-connection prompts, clipboard tampering, hidden forms, cloaking, or credential forms posting off-site were observed. The adverse picture therefore rests on external threat detections and outbound data flows rather than on a visible drainer mechanism. Abuse reports recorded against one of the shared platform addresses are discounted, because they relate to infrastructure used by many unrelated tenants and not specifically to this site. No conflicting legal identities or confirmed brand impersonation were observed. Evidence:

• Homepage: the page title markets "institutional TRON blockchain AML intelligence & forensic analytics", which presents authority and compliance expertise that nothing else in the evidence supports.
• Behavioural sandbox across three successful runs: about 29 external network events, 12 to non-allowlisted destinations, 15 outbound POST requests, 6 of them to non-allowlisted parties.
• Threat-intelligence aggregation: 16 malicious and 1 suspicious detections, including three tier-one security vendors (Fortinet, Kaspersky, Sophos), which triggered an automatic score ceiling.
• Shared-platform abuse reports (81, across Vercel infrastructure) are attributed to common provider addresses and carry no weight against the site itself.

Regulatory Verification Notes

The site's on-page disclosure of operator identity, licensing, and registration is unclear. A platform that markets itself as institutional AML tooling would normally state its operating entity, jurisdiction, and any relevant registrations. None of that was established from the evidence. The shared-subdomain deployment also means there is no standalone registrable domain to anchor ownership. This is a governance and transparency limitation, not an identity contradiction, because no conflicting entity names were found. No third-party broker or regulatory-database match exists for the site, so there is no external reputational context either way. The site's real-world operator therefore remains unconnected to any verifiable institution. Evidence:

• Homepage: no verifiable operating entity, licence, or registration reference could be tied to the AML positioning.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US), registry ARIN, on a shared application platform.
• Transport encryption: TLS certificate issued by WR1, domain-validated only (DV), valid to 2026-11-27. This confirms an encrypted channel but no organisational identity.

What to Verify Next

Before any engagement, the claimed operator should be matched to a real organisation through independent, offline channels, such as a registry search in the jurisdiction it claims. Any partner, customer, or regulator references the site makes should be confirmed directly with those parties, not through links on the site. The official contact channels of the supposed provider should be established from sources outside this site. Any data already submitted to the site should be reviewed, and any shared credentials rotated. Evidence:

• Homepage: institutional and forensic-grade claims are made without verifiable third-party attestation.
• Outbound traffic: submissions to non-allowlisted destinations mean any data entered could reach parties unrelated to the site.
• Reputation checks: multiple major vendors currently list the site, so re-checking its status after any claimed remediation is warranted.

Summary Verdict

The site carries an elevated, clearly cautionary risk posture. Confirmed external threat detections outweigh its technically sound baseline, and nothing in the evidence connects it to an identifiable, accountable institution. Its appearance of professionalism does not offset the adverse reputation, and it should not be treated as a trustworthy compliance provider.

Infrastructure Integrity

The site resolves to Amazon-hosted edge addresses on a shared application platform, and all observed addresses are edge servers, so the origin server was not observable. This arrangement is a mitigating factor: it indicates mainstream, professionally operated infrastructure with a valid certificate. It is not evidence of legitimacy. Edge-only visibility also prevents independent verification of where content is actually served from, and it can mask rapid content changes.

Closing Assessment

The site should be limited to passive viewing at most. No login, credential entry, data submission, or financial interaction should take place with it, and any engagement should wait until the operator is independently verified and the external detections are cleared.

Signals weighed against the site

• AbuseIPDB: 81 reports on hosting IP 64.29.17.131 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.