crypto-aml[.]app

This domain, crypto-aml.app, operates as a fraudulent TRON compliance portal designed to drain cryptocurrency from victims' wallets. The site presents itself as 'Aurora Sentinel — Wallet-bound TRON compliance pass,' a fictitious service likely targeting users seeking regulatory compliance solutions. Analysis indicates the site employs wallet-draining scripts, a common tactic in crypto phishing campaigns, where malicious JavaScript intercepts and redirects funds during transactions. The use of compliance-themed lures suggests an attempt to exploit users' concerns about regulatory scrutiny in the cryptocurrency space. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 24, 2024, through Google LLC, an unusual choice for phishing sites, which often use privacy-focused registrars. It resolves to the IP address 188.114.97.3 and employs a Let's Encrypt SSL certificate, a common tactic to appear legitimate. Detection metrics further confirm the threat: 9 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on at least one security blocklist. The site was subsequently taken offline, though its infrastructure may remain active for future campaigns. Users who visited crypto-aml.app or interacted with its content should take immediate action to mitigate risks. First, disconnect any wallets linked to the site and revoke all connected dApp permissions using a blockchain explorer or wallet management tool. Next, scan the device for malware, as phishing sites may deploy additional payloads. Monitor wallet addresses for unauthorized transactions and consider transferring funds to a new wallet if suspicious activity is detected. Given the elevated risk level, affected users should also report the incident to relevant blockchain security teams and law enforcement agencies specializing in cybercrime. Vigilance is advised, as similar domains may emerge using comparable lures.