trx-aml[.]today

This domain, trx-aml.today, is confirmed to facilitate cryptocurrency credential theft, specifically targeting users of TRON-based wallets and services. Analysis indicates the site employs deceptive prompts mimicking legitimate anti-money laundering (AML) verification processes to harvest wallet login credentials, recovery phrases, and private keys. The fraudulent interface is designed to exploit users' trust in compliance procedures, increasing the likelihood of successful credential compromise and subsequent unauthorized asset transfers. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., a provider frequently leveraged by malicious actors to obscure hosting details and evade detection. As of the latest assessment, trx-aml.today resolves to the IP address 172.67.220.75 and is flagged by 6 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and was previously documented in a single threat intelligence pulse, suggesting limited but targeted distribution. The page title, 'Nur einen Moment…,' is consistent with temporary redirect or loading pages used to mask the true nature of the site during initial access. Users who visited trx-aml.today should immediately revoke any permissions granted to the site via wallet connections or browser extensions. All potentially exposed credentials, including wallet passwords, recovery phrases, and private keys, must be considered compromised and should be migrated to new, secure wallets. Affected individuals are advised to monitor transaction histories for unauthorized activity and report the incident to relevant cryptocurrency platforms or security response teams. Proactive measures, such as enabling multi-factor authentication and verifying domain authenticity before entering sensitive information, are strongly recommended to mitigate future risks.