aml-tron[.]app

This domain, aml-tron.app, was observed hosting a wallet/seed phishing page that presented the title “TRON AML Screening — Simple Wallet Risk Check.” The page title suggests an attempt to lure users seeking anti‑money‑laundering verification for TRON wallets, aligning with the reported scam type of wallet/seed phishing. The domain was registered on February 21 2026 and resolves to the Cloudflare address 104.21.54.164, located in the United States and announced under ASN 13335. SSL analysis shows a certificate labeled WE1, indicating the site employed HTTPS, a common tactic to increase perceived legitimacy. VirusTotal scans recorded nine positive detections out of ninety‑three submitted engines, confirming that multiple security vendors flagged the site as malicious.

Independent blocklist services—including PhishDestroy, Polkadot, Enkrypt, and Codeesura—have listed the domain, and overall the domain appears on four security blocklists. These independent sources corroborate the malicious classification. The current status is offline, implying that the phishing page is no longer reachable. Nevertheless, the infrastructure remains relevant: the Cloudflare IP address is shared across many unrelated services, and the domain’s recent creation date suggests a short‑lived campaign that may be re‑used with a different domain.

Defenders should continue to deny traffic to aml‑tron.app at network borders, add the associated IP 104.21.54.164 to block lists, and monitor for re‑registration of the domain or similar patterns in newly observed domains. Updating URL filtering rules with the exact page title string can aid in early detection of copycat pages. Ongoing observation of the listed blocklists and any future VirusTotal submissions is recommended to capture potential resurgence.