trx-aml[.]net

On July 24 2026, analysis of the domain trx-aml.net indicates it was registered on August 15 2025 through Web Commerce Communications Limited and uses Cloudflare’s DNS (dom.ns.cloudflare.com, ligia.ns.cloudflare.com). The site resolves to the Cloudflare edge address 104.21.46.105, which is associated with AS13335 in the United States. No SSL certificate was observed, and HTTP requests return an offline status, suggesting the infrastructure has been taken down or is otherwise inaccessible. The only visible page title retrieved before takedown was “AML Check”, and the domain is explicitly linked to a crypto‑scam that impersonates the CSGO brand.

VirusTotal recorded a single positive detection out of 95 scanned vendors, and the domain appears on one public blocklist, where it is also listed by PhishDestroy as a blocked entry. The combination of brand impersonation, a crypto‑focused lure, and the use of Cloudflare’s CDN aligns with known patterns of opportunistic financial fraud campaigns. Evidence gaps remain regarding the exact payload or phishing page content, as the site is offline and no screenshots or HTML samples have been captured.

Defenders should continue to monitor the IP address 104.21.46.105 for any resurgence of malicious activity, enforce blocklisting of the domain in web filters, and consider adding it to internal threat‑intel feeds. Organizations using CSGO‑related services should educate users about unsolicited “AML Check” prompts and verify URLs before providing any cryptocurrency credentials. Ongoing vigilance is recommended until the infrastructure is confirmed fully dismantled.