aml-trc20scan[.]com

This domain is flagged as a high-risk brand impersonation threat specifically targeting CSGO users. Analysis indicates the site was designed to mimic legitimate anti-money laundering (AML) verification processes, likely to harvest credentials or facilitate unauthorized transactions under the guise of compliance checks. Infrastructure analysis reveals the domain aml-trc20scan.com was registered on November 28, 2025, through Metaregistrar BV. It resolves to the IPv6 address 2606:4700:3035::ac43:a46e and is hosted behind Cloudflare, utilizing HTTP/3. The SSL certificate is issued by Google Trust Services. Detection metrics show 14 out of 95 security vendors on VirusTotal flag the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on seven security blocklists and is actively blocked by multiple wallet security providers, including MetaMask and PhishDestroy. Mitigation steps for this brand impersonation threat include immediate blacklisting of the domain and its associated IP address across all network security controls. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems, particularly focusing on CSGO-related user environments. Security teams are advised to monitor for unauthorized access attempts originating from this domain and conduct retrospective analysis of logs for prior connections. Users should be educated on recognizing fraudulent AML verification requests, especially those deviating from official CSGO communication channels. Given the domain's offline status, continuous monitoring for re-emergence under similar naming conventions is recommended.