Is amlcrystal-scanner.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents itself as "AML Crystal Scanner," a pay-per-use blockchain compliance tool for the TRON network. It offers to screen TRX wallets, USDT TRC20 addresses and transaction hashes for sanctions exposure, mixer activity and dark-market links. Its business model is wallet-signed micropayments in USDT per scan, bulk pack or API call, plus custom enterprise plans.

Scam/Impersonation Risk

Contradictory signals are present, and they drive the cautionary posture of this assessment. The domain is confirmed blacklisted. Several independent threat-intelligence engines flag it as malicious or suspicious, including a major security vendor, and an external blacklist corroborates this. The abuse reports that attach to the shared provider address behind the site are a different matter. They apply to infrastructure used by many unrelated tenants, so they are discounted and are not counted against the site itself. The homepage offers a polished, "Matrix"-styled interface and claims regulator-grade, FATF-aligned output. It states that scans cover OFAC, EU, UN and HM Treasury lists over a 10-hop transaction graph, and it names no methodology, data provider or accountable company. A service whose product is compliance assurance gives users nothing independent to verify that assurance against, which is a claim-versus-evidence dissonance. The page also promotes a connect-wallet flow with a long list of supported wallets (TronLink, Trust Wallet, WalletConnect, Ledger, Binance Web3 and others). Its FAQ reassures visitors that the operator "never has access to your funds" and that they "only sign transactions" they approve. Those are self-assertions, and the page discloses no payment recipient address. Behavioral testing observed prompts for wallet connection and transaction signature, and a notable volume of outbound requests and POSTs to non-allow-listed third-party destinations. The page references a broad token set (TRX, USDT, USDC, WTRX, JST, SUN, BTT, WIN), far wider than a TRC20 scanner needs. No identity contradiction between legal entities was observed, but the site's only visible identity is a free-tier application subdomain with no independent brand footprint. Evidence:

• Homepage: asserts "regulator-grade" and FATF-aligned risk output and sanctions coverage across four authorities, with no methodology or data-source disclosure.
• Homepage FAQ: states "We never have access to your funds" while soliciting wallet connection and signed payments, with no named payment recipient.
• Browser behavior capture: wallet-connection prompt and transaction-signature request flags, with 6 of 15 external POSTs and 6 of 14 external XHR calls going to non-allow-listed destinations.
• Reputation checks: 4 malicious and 1 suspicious detections from threat-intelligence engines, plus a confirmed external blacklist hit.

Regulatory Verification Notes

The service operates in a regulated-adjacent domain, but the site presents no legal operator, company name, registration number, physical address, refund terms or terms of service. It claims no license, and none is verified. This is a disclosure gap in a high-stakes financial context, and it compounds the reputational findings. Ownership and governance are opaque from the public content. No third-party broker or regulatory record matched the site, so no external regulatory standing can be attributed to it. The page markets compliance authority while naming no accountable entity. That is the opposite of what genuine AML vendors normally publish. The technical profile is ordinary and does not offset the content and reputation findings. Evidence:

• Homepage and pricing sections: scans priced from 0.10 USDT, bulk packs at 0.05 USDT and API calls at 0.02 USDT, with no operator, payee or refund policy stated.
• Site-wide: no about, contact or legal pages with entity details were found.
• Hosting infrastructure: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by WR1 at domain-validated (DV) level, valid to 2026-11-27. DV validation confirms control of the domain only and does not establish who operates it.

What to Verify Next

Any engagement should start from independent proof of who operates this service. Request the operating company's legal name, jurisdiction and registration number through a channel the site does not control, and check them against the relevant corporate registry. Ask for the scoring methodology, the data providers behind the sanctions and mixer screening, and a sample report that can be cross-checked against an established blockchain-analytics provider. Confirm the payment recipient address and refund terms in writing before any funds move. Confirm the official support and contact channels through an independent, offline route. Check whether any recognized compliance or analytics vendor endorses or integrates this product. Evidence:

• Homepage: lists REST API and PDF/JSON report features but no documentation, named provider or sample output.
• Pricing section: no payment recipient or refund terms are stated.
• Reputation checks: current malicious detections should be re-checked for delisting before any reassessment.

Summary Verdict

The site is classified as high-risk. Confirmed blacklisting and malicious detections converge with unverifiable compliance claims and an unidentified operator, and these outweigh its professional presentation and valid encryption. Available evidence does not support treating it as a legitimate compliance provider. Its handling of wallet connections and signed payments places it among services where financial exposure is the central concern.

Infrastructure Integrity

The site is hosted on Amazon infrastructure (AS16509, US), behind a CDN/WAF layer. All six observed IP addresses are edge servers, and the origin server is not observable. Protective edge infrastructure and a valid certificate are mitigating factors only. They do not establish legitimacy, and they cannot offset the reputation risk. Edge-only visibility also prevents independent hosting verification and can mask rapid content swaps.

Closing Assessment

Use should be limited to read-only viewing. Wallets should not be connected, no transaction should be signed, and no USDT or other payment should be sent. No credentials or financial information should be submitted. Compliance screening that matters should be done with established, identifiable providers.

Signals weighed against the site

• AbuseIPDB: 82 reports on hosting IP 216.198.79.67 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.