aml-trn[.]com

Analysis of the domain aml-trn.com indicates it was actively involved in a wallet and seed phishing campaign targeting users of the cryptocurrency exchange Bitget. The domain was registered on May 29, 2025, through Web Commerce Communications Limited and resolved to the IP address 104.21.56.176, hosted on Cloudflare's network (AS13335). Infrastructure analysis reveals the use of Cloudflare nameservers (DONNA.NS.CLOUDFLARE.COM and NASH.NS.CLOUDFLARE.COM), a common tactic to obscure hosting origins and evade takedowns. No SSL certificate was detected, increasing the likelihood of interception or manipulation of user data in transit. The page title, 'AML Check,' suggests the site impersonated a Know Your Customer (KYC) or Anti-Money Laundering (AML) verification process, a technique frequently employed to harvest wallet seeds or credentials under the guise of compliance.

The domain was flagged by one security blocklist and identified by PhishDestroy as part of a wallet/seed phishing operation. As of July 22, 2026, the domain is offline, though its prior activity and infrastructure remain relevant for retrospective detection. Two of 95 security vendors on VirusTotal flagged the domain as malicious, providing additional corroboration of its harmful intent. Defenders should treat this domain as a confirmed threat vector for cryptocurrency-related phishing.

Indicators of compromise (IOCs) include the domain name, IP address 104.21.56.176, and the 'AML Check' page title. Network security teams are advised to block or monitor traffic to this domain and its associated IP, particularly in environments where Bitget or similar platforms are used. Given the domain's use of Cloudflare, further investigation into related infrastructure may uncover additional malicious assets. The absence of an SSL certificate and the domain's presence on a security blocklist further justify its classification as a high-risk artifact, even in its current offline state.