trx[.]amlscanchain[.]org

The domain trx.amlscanchain.org is a confirmed phishing site engaged in brand impersonation targeting AMLBot, a cryptocurrency compliance service. It presents itself as an 'AML Check' platform to deceive users into interacting with fraudulent cryptocurrency transactions. As of the latest verification, trx.amlscanchain.org has been taken offline, though it previously posed a direct risk of financial loss through scam activities.

Technical analysis of trx.amlscanchain.org reveals minimal detection at the time of assessment, with 0 of 95 VirusTotal vendors flagging the domain. The domain was created on 2026-02-21 and resolves to the IP address 104.21.80.1, hosted on Cloudflare's infrastructure in the US. It appears on 1 security blocklist, specifically PhishDestroy, and uses an SSL certificate issued by WE1. No registrar information is currently available, and no drainer kit was identified in this case.

Users who may have interacted with trx.amlscanchain.org should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. Enable two-factor authentication on all cryptocurrency and financial accounts, and monitor for unauthorized transactions. Report the phishing domain to platforms like PhishTank, Google Safe Browsing, and the impersonated brand, AMLBot, to assist in broader mitigation efforts.