tron-aml[.]org

The domain tron-aml.org is a confirmed phishing site engaged in brand impersonation targeting AMLBot, a cryptocurrency compliance service. It poses as a legitimate TRON-based AML (anti-money laundering) verification tool but is designed to deceive users into disclosing sensitive information or transferring cryptocurrency under false pretenses. As of the latest verification, tron-aml.org has been taken offline, though it previously operated as a cryptocurrency scam without evidence of a drainer kit.

Technical indicators for tron-aml.org show limited detection at the time of analysis. The domain registered 0 of 95 detections on VirusTotal and was not flagged by Google Safe Browsing. It appeared on 1 security blocklist, specifically PhishDestroy. The domain was created on 2026-02-21 and resolved to the IP address 104.21.68.168, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate was issued by WE1, and the observed page title was 'TRON AML Check'. No registrar information was available for this domain.

Users who interacted with tron-aml.org should assume their credentials or transaction details may have been compromised. For cryptocurrency-related phishing, revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. Enable two-factor authentication (2FA) on all accounts and monitor for unauthorized transactions. Report the domain to relevant platforms, including the impersonated brand (AMLBot), blockchain security teams, and organizations like PhishTank or the Anti-Phishing Working Group (APWG) to aid in takedown efforts.