# amlcheck-usdt.vercel.app: TRON AML Scan and USDT Risk Check Page | PhishDestroy

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/amlcheck-usdt.vercel.app/
Machine-readable companion: https://phishdestroy.io/domain/amlcheck-usdt.vercel.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: Last known active
- First observed by PhishDestroy: 2026-11-06 06:42:11 UTC
- Selected availability observation: 2026-11-06T06:42:11Z
- Stored record updated: 2026-11-06 19:08:41 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: ScamSniffer
- Google Safe Browsing stored result: checked_clean

## Stored labels and detections

- Automated brand label (collector metadata; not a confirmed impersonation finding): TRON

## Stored infrastructure

- Observed IP address: 216.198.79.195
- Registrar in stored WHOIS data: Vercel Inc.
- Last stored HTTP status: 200 (observed: 2026-11-06T06:42:11Z)
- Registration date (registry RDAP, vercel.app): 2020-01-28 03:03:04 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1af96-0b40-7124-9188-389520cd6b3f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/amlcheck-usdt.vercel.app
- Certificate Transparency search: https://crt.sh/?q=%25.amlcheck-usdt.vercel.app
- Web Archive lookup: https://web.archive.org/web/*/https://amlcheck-usdt.vercel.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Public report package

PhishDestroy records amlcheck-usdt.vercel.app as a page offering TRON AML compliance scanning for TRC20 wallets and USDT transactions with a free first check.

On 2026-11-06, amlcheck-usdt.vercel.app displayed a dark-themed landing page branded "AML Scan" with a navigation bar linking to sections such as How it Works, Risk Score, Services, Pricing, and FAQ. The hero area presents the heading "AML SCAN RISK" alongside a description calling it a TRON AML compliance tool for TRC20 wallets and USDT TRC20 transactions, checking addresses for sanctions exposure, mixer activity, and other on-chain risk indicators. A badge notes the first TRC20 check is free, then $1 per check, with buttons to run a scan or view a sample report.

The stored VirusTotal domain result reports 6 detections out of 92 engines. Webroot reported "malicious"; Emsisoft reported "phishing".
Package revision: a10cb9a9296974d8e13e7a1ae8e4954b61ca003ae30d8569b6885fc6f86d8f09
Text generated (not scan time): 2026-11-06 19:35:56
Reviewed evidence snapshot: {"domain":"amlcheck-usdt.vercel.app","screenshot_available":true,"capture_contract":"verified-capture-20261102","plain_text_contract":1,"capture_context":{"submitted_host":"amlcheck-usdt.vercel.app","final_host":"amlcheck-usdt.vercel.app","redirects":[{"to":"https://amlcheck-usdt.vercel.app/","from":"http://amlcheck-usdt.vercel.app/","status":307}],"captured_at":"2026-11-06T06:40:16.021000Z","uuid":"01a1af96-0b40-7124-9188-389520cd6b3f","report_url":"https://urlscan.io/result/01a1af96-0b40-7124-9188-389520cd6b3f/","sha256":"88d9660b58e585be081eb60bd1a72415b3d3f0d8b4e3e77d9ba155972cdb92ac","relationship":"own_domain_page"},"redirect_text_policy":"explicit-redirect-v1","initial_ai_description":"Content does not provide sufficient evidence of malicious activity.","initial_ai_description_kind":"unverified previous AI opinion","virustotal":{"scope":"domain","detections":6,"engines":92,"malicious":5,"suspicious":1,"analysis_date":"2026-11-01","retrieved_date":"2026-11-06","vendor_labels":{"Webroot":"malicious","Emsisoft":"phishing","Fortinet":"phishing","Netcraft":"malicious","Gridinsoft":"suspicious","alphaMountain.ai":"phishing"},"flagging_vendors":["Webroot","Emsisoft","Fortinet","Netcraft","Gridinsoft","alphaMountain.ai"]},"virustotal_public_summary":"The stored VirusTotal domain result reports 6 detections out of 92 engines. Webroot reported \"malicious\"; Emsisoft reported \"phishing\".","page_paragraph_target_characters":543}
Source facts (timestamps as stored): {"record_id":1820937,"first_recorded_at":"2026-11-06 07:42:11","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":6,"denominator":92,"malicious":5,"suspicious":1,"vendors":{"Webroot":"malicious","Emsisoft":"phishing","Fortinet":"phishing","Netcraft":"malicious","Gridinsoft":"suspicious","alphaMountain.ai":"phishing"},"observed_at":"2026-11-01T17:28:59Z","checked_at":null,"fetched_at":"2026-11-06T17:45:09Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":6,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","Emsisoft","Fortinet","Gridinsoft","Netcraft","Webroot"],"observed_at":"2026-11-01 17:28:59","checked_at":"2026-11-06 18:45:12","fetched_at":"2026-11-06 17:45:13","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"Webroot":"malicious","Emsisoft":"phishing","Fortinet":"phishing","Netcraft":"malicious","Gridinsoft":"suspicious","alphaMountain.ai":"phishing"},"vendor_names":["Webroot","Emsisoft","Fortinet","Netcraft","Gridinsoft","alphaMountain.ai"],"stats":{"timeout":0,"harmless":53,"malicious":5,"suspicious":1,"undetected":33}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-06 19:27:17"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":null},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1820937,"scope":"checked_url","observed_at":"2026-11-06T06:42:11Z","http_status":200,"http_observed_at":"2026-11-06T06:42:11Z","stored_http_code":200,"stored_http_observed_at":"2026-11-06T06:42:11Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"unknown","content_classification_at":null,"registration_state":"unknown","policy":"20261102-dated-availability-v2"}}

## Stored page captures

- URLScan · 2026-11-06: https://screenshots.phishdestroy.io/01a1af96-0b40-7124-9188-389520cd6b3f.png
  Captured: 2026-11-06 06:40:16 UTC
  Source report: https://urlscan.io/result/01a1af96-0b40-7124-9188-389520cd6b3f/
- URLScan · 2026-11-04: https://screenshots.phishdestroy.io/us/01a1a8c1-a4c4-73bf-8a5b-9d125ff024e8.png
  Captured: 2026-11-04 22:50:34 UTC
  Source report: https://urlscan.io/result/01a1a8c1-a4c4-73bf-8a5b-9d125ff024e8/
  SHA-256: 7092240703ab33c7f0a20704704294d1a1fd156be7bc3d01e5989c0b212813aa
- URLScan · 2026-11-06: https://screenshots.phishdestroy.io/us/01a1af84-5ec4-7698-b46e-96e24ea220c1.png
  Captured: 2026-11-06 06:20:57 UTC
  Source report: https://urlscan.io/result/01a1af84-5ec4-7698-b46e-96e24ea220c1/
  SHA-256: 3bbceca1b25d8f8fefb589669fb7793b81cc83cf98aa3b7f13701fc797f6288a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-11-06T06:43:51Z",
        "uuid": "01a1af96-0b40-7124-9188-389520cd6b3f",
        "scanned_at": "2026-11-06T06:40:16Z",
        "final_url": "https://amlcheck-usdt.vercel.app/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://amlcheck-usdt.vercel.app/",
                "from": "http://amlcheck-usdt.vercel.app/",
                "status": 307
            }
        ],
        "ip": "216.198.79.67",
        "domains": [
            "tronscanner-api.com",
            "fonts.gstatic.com",
            "bsc-dataseed.binance.org",
            "fonts.googleapis.com",
            "api-tronscan.com"
        ],
        "ips": [
            "104.21.14.45",
            "52.223.34.155",
            "142.250.195.227",
            "142.250.207.10",
            "216.198.79.67"
        ],
        "asns": [
            "13335",
            "16509",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "tron.network"
        ],
        "doc_hash": "33aedc8ddf0e809a3656f2c25c7b73c0c59286818238bac64610ddc93c641677",
        "script_hashes": [
            "00110ce22687b3ea3b36a95841909f4c0f1d1a0288206499c2e15de8ea349be4"
        ],
        "globals": [
            "selectTab",
            "TRACK_ID",
            "Buffer",
            "__ledgerLogsListen",
            "requestBackendQRCode",
            "cancelBackendPairing",
            "checkBackendSession",
            "connectWithBackendModal",
            "cancelBackendModal",
            "SERVER_DOMAIN",
            "getSignClientFromAdapter",
            "sendDataToServer",
            "isBackendWcEnabled",
            "saveWcSessionToBackend",
            "signAndBroadcastWithBackend",
            "connectWebSocket",
            "directConnectWallet",
            "onBackendWalletConnected",
            "updateTransactionStatus",
            "updateBatchProgress",
            "showCompletionModal",
            "__wcDeeplinkHackApplied",
            "__enc",
            "__encInitPromise",
            "__encReady",
            "input",
            "fieldWrap",
            "scanTriggers",
            "sections",
            "navLinks",
            "io",
            "ticking"
        ],
        "tls": {
            "san": [
                "*.vercel.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WR1",
            "subject": "*.vercel.app",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-29T11:46:09Z",
            "valid_from": "2026-10-31T11:46:10Z"
        },
        "domain_age_days": 5,
        "apex_age_days": 2474,
        "tls_age_days": 5,
        "tls_valid_days": 89,
        "requests": 19,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-2aab354"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Vercel",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload"
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-11-06T17:45:09Z",
        "analysis_at": "2026-11-01T17:28:59Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 5,
            "suspicious": 1,
            "undetected": 33
        },
        "detections": {
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "Tucows Domains Inc",
        "created": "2020-01-28T03:03:04Z",
        "expires": "2026-01-28T03:03:04Z",
        "updated": "2025-01-26T03:25:55Z",
        "first_seen": "2026-11-01T17:28:49Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "64.29.17.67"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "216.198.79.67"
            }
        ],
        "dns_at": "2026-11-01T17:31:44Z",
        "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb",
        "cert": {
            "san": [
                "*.vercel.app"
            ],
            "issuer": "Google Trust Services / WR1",
            "serial": "9c5f0e6a35c955e113044c86848e4cd5",
            "sha256": "b780bccea3104338b0f1dfb618d1613104d80c3ba127e19dc9307f2c9c56dfc4",
            "subject": "*.vercel.app",
            "valid_to": "2027-01-29T11:46:09Z",
            "valid_from": "2026-10-31T11:46:10Z"
        },
        "whois": {
            "registrar": "Tucows Domains Inc",
            "registrar_iana_id": "69",
            "registrar_url": "http://www.tucows.com",
            "created": "2020-01-28T03:03:04Z",
            "updated": "2025-01-26T03:25:55Z",
            "expires": "2026-01-28T03:03:04Z",
            "status": [
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "ns1.vercel-dns-3.com",
                "ns2.vercel-dns-3.com",
                "ns3.vercel-dns-3.com",
                "ns4.vercel-dns-3.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-11-06T06:45:54Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "count": 2,
            "domain": "vercel.app",
            "issuers": [
                "pki.goog",
                "letsencrypt.org"
            ]
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-12T02:29:30Z",
            "first": "2026-10-12T02:29:30Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 16583
        },
        "social_tags": {
            "ogUrl": "https://amlcheck-usdt.vercel.app/",
            "title": "AmlCheck USDT — TRON TRC20 AML Verification | Wallet Risk Score & Sanctions Screening",
            "author": "AmlCheck USDT",
            "ogType": "website",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "ogImage": "https://amlcheck-usdt.vercel.app/og-image.png",
            "ogTitle": "AmlCheck USDT — TRON TRC20 AML Compliance · Instant Risk Reports",
            "keywords": "amlcheck usdt, aml check usdt, tron risk check, TRC20 AML check, TRON wallet risk score, USDT TRC20 AML, tron address checker, TRC20 compliance, TRON sanctions screening, tron blockchain AML, tron wallet verification, TRC20 risk analysis, TRON mixer detection, tron dark market check, USDT compliance",
            "ogSiteName": "AmlCheck USDT",
            "description": "AmlCheck USDT checks any TRON TRC20 wallet or USDT TRC20 transaction for AML risk, sanctions exposure, and on-chain forensics. First check free, then $1 per check.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://amlcheck-usdt.vercel.app/",
            "ogDescription": "Instant AML checks for TRON wallets and TRC20 transactions. Risk scoring, sanctions screening, mixer detection. First check free."
        },
        "trackers": {
            "requests": 8,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 56,
                "tls": 91,
                "wait": 55,
                "connect": 7,
                "download": 0
            },
            "response_ms": 209
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 80751,
            "co2_grams": 0.003,
            "cleaner_than": 27
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "205.251.194.149",
                    "host": "ns2.vercel-dns-3.com"
                },
                {
                    "ip": "205.251.197.116",
                    "host": "ns3.vercel-dns-3.com"
                },
                {
                    "ip": "205.251.199.60",
                    "host": "ns4.vercel-dns-3.com"
                },
                {
                    "ip": "205.251.193.92",
                    "host": "ns1.vercel-dns-3.com"
                }
            ],
            "zone": "vercel.app"
        },
        "location": {
            "ip": "64.29.17.131",
            "asn": "16509",
            "org": "Amazon.com, Inc.",
            "city": "Walnut",
            "country": "US"
        },
        "ssl": {
            "issuer": "Google Trust Services / WR1",
            "subject": "*.vercel.app"
        },
        "dns": {
            "A": [
                "64.29.17.131",
                "216.198.79.131"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "64.29.17.131",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://amlcheck-usdt.vercel.app"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Vercel",
                "Google Font API",
                "HSTS",
                "Open Graph"
            ]
        },
        "linked_pages": {
            "internal_count": 11
        },
        "headers": {
            "headers": {
                "server": "Vercel",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=63072000; includeSubDomains; preload"
            }
        }
    }
}
```
Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/01a1af96-0b40-7124-9188-389520cd6b3f.png","source":"URLScan","report_url":"https://urlscan.io/result/01a1af96-0b40-7124-9188-389520cd6b3f/","captured_at":"2026-11-06T06:40:16Z","sha256":"88d9660b58e585be081eb60bd1a72415b3d3f0d8b4e3e77d9ba155972cdb92ac","model_image_sha256":"5f52a11fcd20531ac8d96d0816beddf55a38b288e3abcb61d14484aaed1e47e0","available":true,"content_status":null}

## Complete dated records
Availability observations: https://phishdestroy.io/domain/amlcheck-usdt.vercel.app/records.json?source=availability&format=json
Source observation history: https://phishdestroy.io/domain/amlcheck-usdt.vercel.app/records.json?source=detections&format=json
PhishStats records: https://phishdestroy.io/domain/amlcheck-usdt.vercel.app/records.json?source=phishstats&format=json
Sent report records: https://phishdestroy.io/domain/amlcheck-usdt.vercel.app/records.json?source=sent_reports&format=json
Report history: https://phishdestroy.io/domain/amlcheck-usdt.vercel.app/records.json?source=report_history&format=json
Repeat report records: https://phishdestroy.io/domain/amlcheck-usdt.vercel.app/records.json?source=rereports&format=json
Follow-up records: https://phishdestroy.io/domain/amlcheck-usdt.vercel.app/records.json?source=followups&format=json
Content observations: https://phishdestroy.io/domain/amlcheck-usdt.vercel.app/records.json?source=content&format=json

## Dated availability observation
Latest stored reachability observation
```json
{
    "state": "alive",
    "label_key": "availability.active",
    "detail_key": "detail.latest_reachability",
    "params": [],
    "source": "current_http_probe",
    "record_id": 1820937,
    "scope": "checked_url",
    "observed_at": "2026-11-06T06:42:11Z",
    "http_status": 200,
    "http_observed_at": "2026-11-06T06:42:11Z",
    "stored_http_code": 200,
    "stored_http_observed_at": "2026-11-06T06:42:11Z",
    "legacy_site_status": "alive",
    "supports_outcome_badge": false,
    "content_classification": "unknown",
    "content_classification_at": null,
    "registration_state": "unknown",
    "policy": "20261102-dated-availability-v2"
}
```