amlcheker[.]vercel[.]app

The domain amlcheker.vercel.app is currently under investigation for brand impersonation, specifically targeting Trust Wallet, a widely used cryptocurrency wallet service. Analysis indicates the site presents itself as an advanced anti-money laundering (AML) verification tool for crypto wallets, using the page title 'AMLCheker Scan | Erweiterte AML-Krypto-Wallet-Verifizierung.' This type of impersonation is designed to deceive users into believing they are interacting with a legitimate Trust Wallet service, potentially leading to credential theft or unauthorized access to cryptocurrency assets. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 21, 2026, and resolves to the IP address 64.29.17.3, hosted on Amazon.com, Inc.'s AS16509 network in the United States. Despite its active status, the domain has not been flagged by any of the 95 vendors on VirusTotal as of the latest scan. However, it appears on one security blocklist, indicating preliminary detection by at least one threat intelligence source. The SSL certificate is issued by Google Trust Services (WR1), which does not inherently validate the legitimacy of the site but ensures encrypted connections. Current evidence suggests the domain remains operational and poses a potential risk to users unfamiliar with Trust Wallet's official verification processes. The lack of VirusTotal detections does not guarantee safety, as the domain may still be in the early stages of deployment or evading detection through obfuscation techniques. Users are strongly advised to avoid interacting with the site and to verify any AML or wallet verification requests directly through Trust Wallet's official channels. Organizations should consider adding this domain to their blocklists and monitoring for related infrastructure, such as subdomains or associated IP ranges, to mitigate potential threats.