aml-check[.]online

The domain aml-check.online is a phishing site engaged in brand impersonation targeting Trust Wallet users. It presents itself as a legitimate anti-money laundering (AML) verification page for the cryptocurrency wallet service, aiming to deceive victims into disclosing sensitive information or transferring funds. No drainer kit was observed, but the site is classified as a cryptocurrency scam. As of the latest verification, aml-check.online has been taken offline.

Technical indicators confirm the malicious nature of aml-check.online. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Fortinet and Gridinsoft, while appearing on 1 security blocklist (PhishDestroy). Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 21, 2026, the domain resolves to the IP address 172.67.138.62, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate is issued by Let's Encrypt (E7), and the observed page title was 'Trust Wallet AML'. Nameservers are leonard.ns.cloudflare.com and martha.ns.cloudflare.com. Google Safe Browsing has not flagged the domain.

Victims of aml-check.online should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new cryptocurrency wallet. If login credentials were entered, users should change their Trust Wallet password and enable two-factor authentication (2FA) on all associated accounts. Monitor financial statements for unauthorized transactions and report the incident to Trust Wallet's official support channels. The domain can also be reported to PhishDestroy and other anti-phishing organizations to aid in takedown efforts.