Is amlscannes.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

AMLScan Two presents itself as a free Tron AML checker that screens TRC20 wallet addresses and returns a risk score. The site is a single-page tool hosted on a subdomain of a shared application-hosting platform rather than on a standalone branded domain. Its apparent purpose is to attract users who want to check blockchain wallets for illicit-fund exposure, and it carries no visible commercial model beyond the "free" positioning.

Scam/Impersonation Risk

Contradictory signals are present and they are decisive. Multiple independent security engines currently classify the site as malicious, and the detections are strong enough to place it on a confirmed blacklist. The engines include several tier-one endpoint-security vendors. No page-level evidence explains what the detections relate to. No brand impersonation, conflicting legal identities, or credential-harvesting forms were observed. The detection stands on its own and is not offset by the clean technical behavior below. A wallet-screening tool is also a naturally attractive lure. Visitors paste wallet addresses and rely on the returned "risk score" to judge counterparties. A fraudulent or manipulated checker could therefore harvest address data or issue falsely reassuring verdicts, and nothing in the evidence lets that scenario be ruled out. Sandbox runs were otherwise stable. No wallet-connection prompts, clipboard tampering, hidden forms, cloaking, or fingerprinting were observed. The page does generate a heavy volume of outbound requests to third-party destinations, including several unrecognized endpoints that receive POST traffic. This is a data-flow concern for any wallet address entered on the page. Abuse reports exist against a network address used by the hosting platform, but they relate to shared infrastructure rather than to this site, so they are discounted and are not treated as evidence against it. Evidence:

• Homepage and site-wide reputation: a large number of security engines flag the site as malicious and one more as suspicious, including three leading endpoint-security vendors.
• Homepage behavioral runs: roughly half of observed network requests go to external destinations, and 12 external background requests were made. Three of the external POSTs went to non-allow-listed destinations.
• Homepage behavioral runs across three sessions: no wallet-drainer, clipboard-write, hidden-form, or cloaking behavior was detected.

Regulatory Verification Notes

The site claims to perform compliance-grade AML screening but identifies no operating company, regulator, licence, or registration. The available legal and identity disclosure is unclear, and the real-world operator is not independently verified. Governance and ownership opacity are both present. Being served from a shared platform subdomain adds no corporate identity of its own. A service that scores wallets for risk without disclosing who stands behind its methodology, data sources, or accountability cannot be treated as an authoritative compliance resource. No third-party broker or regulatory-database match exists, so there is no external attestation either way. Technical hygiene is basic and does not support the site's legitimacy. The transport encryption is valid, but it is only domain-validated, which proves control of the hostname and nothing about the operator. Evidence:

• Homepage (about 21,700 characters of captured text): no operating entity, licence number, or regulatory registration is stated.
• Hosting infrastructure: served from AS16509 (AMAZON-02, Amazon.com, Inc., US), registry ARIN.
• Transport encryption: TLS certificate issued by WR1 at domain-validated level, valid to 2026-11-27.

What to Verify Next

The decisive reputation findings must be resolved before the site is used for anything beyond viewing. The operator should be asked to name the legal entity, the data sources behind the scoring, and the specific reason for the security-vendor detections. Any claim of compliance capability should be checked against the registry of the relevant jurisdiction. For actual AML decisions, results should be cross-checked with an established, identifiable screening provider. The site's official contact channels should be confirmed through an independent route. Evidence:

• Homepage: the tool presents scores for TRC20 addresses without describing its methodology or data provenance.
• Site-wide reputation: the detections remain unexplained by any visible page content.

Summary Verdict

The overall posture is high-risk and clearly cautionary. Corroborated malicious classifications from multiple independent security sources are decisive. They outweigh the stable page behavior and valid encryption. The site's operator identity is unverified, so legitimacy cannot be inferred from the polished appearance of its tool.

Infrastructure Integrity

The site is served from Amazon-operated address space through a protective CDN/WAF layer. All observed addresses are edge nodes, and the origin server was not observable. This reflects the platform's standard architecture and is a mitigating factor only. Edge-only visibility prevents independent hosting verification and can mask rapid content swaps. Protective infrastructure cannot offset the reputation findings.

Closing Assessment

The site should be viewed at most in a read-only manner. No wallet addresses, credentials, or financial details should be submitted, and nothing should be downloaded from it. Decisions that depend on wallet risk should rely on an established, identifiable screening provider until the detections are credibly resolved.

Signals weighed against the site

• AbuseIPDB: 90 reports on hosting IP 64.29.17.67 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.