Is getblockaml.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

GetBlockAML presents itself as a crypto anti-money-laundering check and blockchain risk-scoring service. Its homepage is titled as a compliance tool for TRON TRC-20 activity, and it appears to offer wallet and transaction screening to users who want a risk assessment of blockchain addresses. The site runs on a free subdomain of a shared application-hosting platform instead of a standalone branded domain, so the visitor sees a compliance-themed product with no domain-level brand identity behind it.

Scam/Impersonation Risk

The decisive finding is a confirmed blacklist condition. Several major security vendors currently classify the site as malicious, and a further vendor rates it suspicious. The detection volume is high enough to trigger an automatic external-blacklist override of the site's standing. The signal is corroborated by the site's behaviour. During sandbox browsing, a large share of its network traffic went to third-party destinations, and a portion of the outbound data submissions went to destinations outside the recognised-service set. A tool that markets itself as a compliance and risk-screening product has no obvious reason to send data to unfamiliar endpoints. No wallet-connection prompts, clipboard tampering, hidden forms, credential forms posting off-site, or content cloaking were observed. The negative finding therefore rests on external threat classification and outbound traffic patterns, not on a confirmed credential-harvesting mechanism. Roughly eighty abuse reports are filed against the serving IP address. These are attributed to shared hosting infrastructure used by many unrelated tenants and are discounted, so they are not evidence against this site specifically. No conflicting legal identities were observed. The credibility of the "AML compliance" positioning is undermined by the malicious classifications. A site that claims to protect users from illicit finance should not be treated as a trusted screening authority while it carries them. Evidence:

• Homepage: the page title markets a "Crypto AML Check & Blockchain Risk Scoring" and "TRON TRC-20 Compliance Tool" service, and the page was captured with substantial text content.
• Security reputation: 13 vendors flag the site as malicious and 1 as suspicious, including two top-tier vendors, which activated the external kill switch.
• Homepage behavioural sandbox: 12 external XHR/POST requests were observed, 3 of them to non-whitelisted destinations, with a peak external-traffic share of about 79%. Three console errors were recorded, and no wallet-drainer, clipboard-hijack, hidden-form or cloaking behaviour appeared in 3 successful runs.
• Hosting IP: 85 abuse reports apply to a shared content-delivery IP operated by Vercel, Inc., with a zero confidence score. They were discounted as shared-infrastructure noise.

Regulatory Verification Notes

The evidence offers no independent basis for connecting the site to a real-world company, operator or regulated entity. No third-party broker or regulatory record matched it. The page content was captured, but no corporate registration, licence or named responsible party could be confirmed from the material available. A service that offers AML and compliance scoring would ordinarily be expected to state who operates it and under what authority. The site's identity and regulatory standing should therefore be treated as unestablished. This is a verification gap, not a finding of fraud. The valid TLS certificate shows only that the connection is encrypted. It does not indicate who operates the site or that the site is safe. Evidence:

• Transport encryption: the TLS certificate was issued by WR1 at domain-validation level only, valid to 2026-11-27, with about 31 days remaining.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US), registry ARIN, country US.
• Broker intelligence: no matching third-party broker or regulatory record was found for the site's name.

What to Verify Next

Any prospective user should first establish whether a legitimate organisation operates the service by locating its legal entity name, registration and any financial-compliance authorisation through official company and regulator registries, using search routes that do not start from this site. Official support and contact channels should be confirmed independently, again without following links from the site. The service's claims should also be checked against the project's presence on established developer and security channels. Security teams should review the specific third-party endpoints that receive outbound data submissions from the homepage before the site is accessed from any corporate or wallet-linked environment. Evidence:

• Homepage outbound traffic: about a quarter of external data submissions went to non-whitelisted destinations, which warrants endpoint-level review.
• Homepage identity claims: the site presents a compliance-service brand but no independently confirmed operator in the available material.
• Reputation: the current malicious classifications should be re-checked against the vendors' public listings for any delisting before the site is reconsidered.

Summary Verdict

The site is assessed as high-risk and unsuitable for sensitive interaction. Confirmed malicious classifications from multiple reputable security sources are decisive. They are reinforced by atypical outbound data behaviour, and protective technical features do not offset them. The compliance-tool positioning is unverified and cannot be relied on as evidence of legitimacy.

Infrastructure Integrity

The site is served through the Vercel platform on Amazon-operated network space, and all observed addresses are edge servers. The origin server was not observable, so hosting cannot be independently verified and content could be swapped quickly without a visible infrastructure change. The shared edge layer and working encryption are mitigating factors only. They do not offset the external threat detections, and they say nothing about the intent of the individual site on the platform.

Closing Assessment

The site should not be used for login, credential entry, wallet interaction or any financial activity. At most, it should be opened read-only in an isolated environment, and any AML or risk-scoring output from it should not be relied on. Any user who has already interacted with it should treat entered credentials or linked wallet permissions as exposed and rotate or revoke them.

Signals weighed against the site

• AbuseIPDB: 85 reports on hosting IP 64.29.17.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.