trontest1[.]pages[.]dev

PhishDestroy has identified trontest1.pages.dev as a generic phishing domain that impersonates AMLbot, a platform related to anti-money laundering services. The site was designed to trick users into revealing sensitive information or connecting their cryptocurrency wallets, potentially leading to asset theft. This type of phishing is commonly associated with crypto drainer kits that automatically siphon funds once a user interacts with the malicious page.

Technical indicators reveal a clear threat profile. VirusTotal shows 1 out of 95 security vendors flagging this domain, indicating initial detection but limited coverage. The domain was registered through Cloudflare, Inc. on April 10, 2026, and resolves to IP address 172.66.45.4. Its SSL certificate is issued by Google Trust Services / WE1, lending a false sense of legitimacy. The site also appears on 1 security blocklist, confirming its malicious nature. Notably, the domain is not listed on Google Safe Browsing, which means users relying solely on Chrome's protection might not receive a warning.

As of the latest check, trontest1.pages.dev is offline, suggesting it has been taken down either by the hosting provider or through a security response. However, the domain remains registered and could be reactivated or redirected. Users who may have visited the site should monitor their cryptocurrency accounts for unauthorized transactions and change any credentials entered on the page. PhishDestroy advises caution with any unsolicited links claiming to be from AMLbot and recommends using a dedicated security tool to scan for threats.