Is amlshard.org a scam? TrustSniffer's high-risk assessment: 15/100

Overview

AMLShard is a single-purpose website presenting itself as a free anti-money-laundering checker for USDT on the TRON (TRC20) network. Its homepage title and content position it as a screening utility for crypto addresses and transactions. Its apparent purpose is to attract users who want to assess the risk of a wallet or transfer, and it is offered without charge.

Scam/Impersonation Risk

The evidence shows confirmed contradictions, so the site is treated with elevated caution. Several independent threat-intelligence engines in a multi-engine reputation scan classify the domain as malicious, with an additional engine rating it suspicious. A separate external blacklist also lists it. Together these meet the threshold for a confirmed blacklisting, not a single stray detection. No brand impersonation, phishing page or conflicting legal identity was observed, so the elevated risk rests on the reputation findings and the site's profile. That profile is a newly registered domain offering a free compliance-style tool in a sector where users are asked to submit wallet addresses and transaction details. The tool's trust-themed pitch cannot be separated from that risk. In behavioural testing the homepage loaded stably, but a high share of its network traffic went to third-party destinations. About a dozen external background requests and posts were observed, a portion of them to destinations outside the common, recognised set. Three browser console errors also occurred. The testing showed no wallet-drainer behaviour, clipboard manipulation, hidden forms or cloaking, which keeps the assessment from escalating further, but the outbound data flow is a legitimate concern for any tool that receives addresses and transaction identifiers. Abuse reports exist against the hosting address. They apply to shared provider infrastructure and carry limited weight on their own, but they add to the picture. Evidence:

• Domain registered 2026-07-02 (~0.32 years, ~116 days old), with a one-year registration term to 2027-07-02.
• Reputation scan: 3 engines flag the domain as malicious and 1 as suspicious; a separate external blacklist also lists it.
• Homepage behavioural testing across 3 successful runs: about 50% of requests and up to 80% of activity was external, with 3 posts to non-whitelisted destinations and 3 console errors.
• Hosting address 186.2.175.35 has 6 abuse reports, the latest about 5 days before analysis, attributed to shared provider infrastructure.

Regulatory Verification Notes

The material collected for the site does not tie it to any identifiable operating company, regulator or compliance credential, and the real-world operator's identity remains unverified. Domain registration details are incomplete and give no clear ownership information, which is ownership opacity, not an identity contradiction. A site presenting itself as a compliance and AML utility would ordinarily be expected to name an accountable entity and its terms of service. Here, the transparency gap sits on top of confirmed reputation contradictions, so it carries more weight than it would for an otherwise clean site. No third-party broker or regulatory-database match was found, and the absence of one is not treated as an adverse finding in its own right. Evidence:

• Domain registered through Atak Domain Bilgi Teknolojileri, with incomplete owner details in the registration record.
• Homepage identifies the service only as "AMLShard — Free TRC20 USDT AML Checker", with no operating entity linked to it.
• TLS certificate issued by YR1 (domain-validated only, valid to 2026-12-22), which confirms control of the domain but not the organisation behind it.

What to Verify Next

Before any engagement, the operator's identity should be established independently, for example through corporate registries or published filings that name the legal entity. Any claim of AML or compliance capability should be tested against the client's own records, or against a recognised, well-established analytics provider's output. Where address screening is genuinely needed, a vetted provider should be used in place of this site. Any contact or support channel the site gives should be confirmed through an independent route before it is relied on. Security teams may also wish to watch for re-listing or delisting by the reputation sources over the coming weeks, as that would indicate whether the detections were transient. Evidence:

• The domain is only about four months old, so no long operating record exists to substitute for registry checks.
• The reputation detections are current as of the analysis date, with abuse reports on the hosting address recorded within the preceding week.
• The homepage collects no verifiable corporate details, so the checks above must rely on external sources.

Summary Verdict

The available evidence places the website in an elevated-risk posture, with confirmed reputation contradictions and unverified operator identity that technical hygiene does not offset. Behavioural testing found no overtly malicious mechanics, but the combination of a new domain, multiple threat detections and a trust-themed offering leaves the assessment firmly cautionary.

Infrastructure Integrity

The site is served from a single address at IQWeb FZ-LLC in the United Arab Emirates (AS59692), a data-centre hosting provider. No CDN or web application firewall sits in front of it, so the origin server is directly exposed and there is no protective layer to mitigate the reputation findings. The TLS certificate is valid and chains to a recognised issuer, which provides transport encryption only. It is not evidence of legitimacy. Evidence:

• Served from AS59692 (IQWEB - IQWeb FZ-LLC, AE) on RIPE-registered address space, with a single resolved IP and no edge or CDN vendors detected.
• TLS: YR1-issued DV certificate, valid to 2026-12-22 (56 days remaining at analysis).

Closing Assessment

Use should be limited to read-only viewing, if the site is visited at all. Logins, credentials, wallet addresses tied to real funds and any financial interaction should be avoided until the operator's identity is independently confirmed and the reputation detections are resolved.

Signals weighed against the site

• AbuseIPDB: 6 reports on hosting IP 186.2.175.35 (IQWeb FZ-LLC, Data Center/Web Hosting/Transit), 11% confidence. The reports are attributed to shared infrastructure, not specifically to this website.