aml-check[.]cam

Analysis of aml-check.cam indicates a newly observed wallet/seed phishing infrastructure targeting Binance users. The domain was registered on August 27, 2025 through Dynadot LLC and resolves to IP address 172.67.130.190, which belongs to Cloudflare’s AS13335 network and is geolocated in the United States. DNS resolution is handled by the Cloudflare authoritative nameservers felicity.ns.cloudflare.com and marlowe.ns.cloudflare.com, confirming the use of Cloudflare’s edge services. No TLS certificate is presented, meaning the site operates without HTTPS protection, which is consistent with the reported lack of SSL.

The page title retrieved from the live host prior to takedown reads "Free TRON Energy Rental — Zero-Fee Transactions," suggesting an attempt to lure cryptocurrency enthusiasts with a false value proposition. Trust metrics are extremely low, with Gridinsoft assigning a score of 0 out of 100 and Scamadviser a score of 1 out of 100, reinforcing the malicious nature of the domain. The domain has been added to at least one public security blocklist and is actively blocked by the PhishDestroy service. VirusTotal scanning shows that one of ninety‑five security vendors flagged the domain, indicating that detection is not yet widespread but that at least one scanner identified malicious behavior.

AlienVault OTX reports inclusion of the domain in a single threat‑intel pulse, providing additional corroboration of its use in phishing campaigns. Although the site is currently offline, defenders should continue to monitor the IP address 172.67.130.190 for any re‑hosting of the same payload, enforce blocklists that include aml-check.cam, and consider adding the domain to internal deny lists. Network and endpoint telemetry should be examined for any traces of the "Free TRON Energy Rental" phrasing or wallet/seed extraction attempts, especially in contexts involving Binance credentials.