Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
amltrc.vercel.app shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 16 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 82 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by WR1 | Noted |
| Hosted by | AMAZON-02Server in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
AMLTRC presents itself as a TRON-focused anti-money-laundering (AML) compliance tool and TRC-20 wallet risk scanner, billed on its homepage as a "#1 TRON AML Check". The site is a single-page application hosted as a free subdomain on a shared application-hosting platform rather than on an independently registered brand domain. Its apparent purpose is to let visitors screen cryptocurrency wallet addresses for illicit-fund exposure, which implies it is intended to receive wallet addresses and possibly other user input.
Scam/Impersonation Risk
Contradictory signals are present, and they dominate this assessment. The site is blacklisted by multiple independent threat-intelligence sources, and several major security vendors, including leading endpoint-security brands, independently classify it as malicious. That level of agreement is decisive and cannot be explained away as a single-engine false positive. No conflicting legal entities or brand impersonation were observed, so the contradiction rests on the external detections rather than on identity inconsistencies. The detections are not attributed to any specific malicious behavior on the site. The abuse reports filed against the serving IP address are a separate matter: they relate to the hosting provider's shared infrastructure, they carry no confidence weight on their own, and they are discounted here. They do not drive this conclusion. The behavioral sandbox gave no sign of wallet-drainer activity, clipboard hijacking, hidden forms, cloaking, or credential posting to external hosts. The page nonetheless sends a high proportion of its traffic to third-party destinations, including repeated outbound POST requests, some to destinations outside the recognized-service allowlist. A tool that invites wallet addresses and presents a "#1" ranking that cannot be verified is a plausible lure, because wallet-screening tools attract users who are already handling sensitive financial data. No PAGE-level fraud indicators were extracted, and the on-page content could not be analyzed in depth. Evidence:
- Homepage: the page title advertises a "#1 TRON AML Check & TRC-20 Wallet Risk Scanner" and an "AML Compliance Tool", a superlative that is unsubstantiated on the page.
- Reputation: multiple independent threat-intelligence sources currently flag the domain as malicious or suspicious, and the aggregate verdict is a confirmed blacklist.
- Homepage behavior: across three successful sandbox runs, a large share of requests went to external hosts, with repeated outbound POSTs, a subset to non-allowlisted destinations.
- Shared hosting IP: abuse reports against the serving address were attributed to shared platform infrastructure and discounted.
Regulatory Verification Notes
The site gives no verifiable regulatory standing. For a service branded as an AML compliance tool, this matters: the homepage content gives no evident basis for a regulated-entity or compliance-provider claim, and no operating company, licence, or registration was established. Independent identification of the operator did not succeed, so legitimacy cannot be inferred from the compliance branding. No third-party broker or regulatory-database match was found, and the absence of one is not treated as a finding in itself. What the technical layer does show is conventional: a valid, currently unexpired transport-encryption certificate and a stable HTTP 200 response. Both are baseline hygiene that any hosted application can obtain at no cost, and neither offsets the reputation findings. Evidence:
- Homepage: the compliance and "AML" positioning is made without any visible company, licence, or registration details in the captured content.
- Hosting: the site is served from AS16509 (AMAZON-02 – Amazon.com, Inc., US), as a subdomain on a shared hosting platform.
- Transport encryption: the TLS certificate was issued by WR1 (DV level) and is valid to 2026-11-27, which confirms encryption only, not operator identity.
- Third-party registry: no match was found in the broker-reputation dataset.
What to Verify Next
Any reliance on this site first requires independent identification of the operator, which the available evidence does not provide. Prospective users should look for a named legal entity and a regulator-registered licence through the relevant registry, rather than relying on the compliance branding. They should confirm official contact channels through an independent route. If an AML or wallet-screening service is needed, they should obtain one from a provider reached through a verified, independently sourced address, not through this subdomain. Organizations that observe this domain in email, ads, or messaging should report it to their security team for assessment. Evidence:
- Homepage: the "#1" and compliance-tool claims name no operator or regulator to check against.
- Hosting: the shared-platform subdomain gives no brand-owned domain that can serve as an identity anchor.
- Reputation: the current malicious classifications mean any inbound reference to this domain should be treated as suspect until cleared.
Summary Verdict
The deterministic assessment places this website in the lowest trust tier, with an elevated, clearly cautionary risk posture. Confirmed blacklisting and strong multi-vendor malicious classification outweigh the baseline technical hygiene and the clean behavioral runs. Operator identity is unverified, and the site cannot be treated as a reliable or legitimate service.
Infrastructure Integrity
The site is served through a CDN and WAF layer on Amazon-operated address space. Every observed address is an edge node and the origin server was not observable. This is a mitigating factor only. Edge-only visibility prevents independent verification of the hosting and can mask rapid content swaps, and it does not offset the external threat detections.
Closing Assessment
The site should be limited to read-only viewing, if it is visited at all. No wallet addresses, credentials, or payment details should be entered, and no financial interaction should take place. Anyone who has already used the site should treat any submitted data as exposed and should monitor or secure the affected accounts and wallets.
Written analysis generated 2026-10-26 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page sent data to a destination TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_POSTS - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY - The page sent data to other domains many times while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_POSTS_HEAVY
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 82 reports on hosting IP 64.29.17.131 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of amltrc.vercel.app.
- The request stayed on amltrc.vercel.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 64.29.17.131 |
| Name servers | Not available |
| CDN / edge network | Detected |
| Resolved IP addresses | 8 |
| Edge IP addresses | 8 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR1 |
| SSL expiry | 2026-11-27 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 16 flagged | AbuseIPDB: 0% confidence, 82 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about amltrc.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.