stag[.]dda2c9z1luzh3[.]amplifyapp[.]com

The domain stag.dda2c9z1luzh3.amplifyapp.com was registered through NOM‑IQ Ltd dba Com Laude on 17 April 2018. Infrastructure analysis shows the domain resolves to the IP address 52.222.214.64, which is owned by Amazon.com, Inc. (AS16509) and geolocated in Germany. No TLS certificate is present, indicating the site was served over plain HTTP. The authoritative nameservers are ns-1165.awsdns-17.org, ns-1683.awsdns-18.co.uk, ns-169.awsdns-21.com, and ns-904.awsdns, all typical of AWS DNS hosting. The page title returned by the server is "Trezor Suite," matching the declared brand target of Trezor. The campaign is classified as Wallet/Seed phishing, suggesting an attempt to harvest cryptocurrency wallet credentials or recovery seeds.

Detection telemetry reports that 14 of 95 security vendors on VirusTotal flagged the domain, and Gridinsoft assigned a trust score of 0 / 100. The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. Despite these indicators, the current HTTP status is offline, and the domain is no longer actively serving content.

Based on the available evidence, the domain exhibits classic impersonation characteristics: a legitimate‑sounding sub‑domain under an AWS Amplify host, a brand‑specific page title, and a low trust score. Defenders should continue to block the domain and its associated IP address, add the domain to internal threat feeds, and monitor for any re‑activation or similar patterns in AWS‑hosted sub‑domains. Users of Trezor products should be reminded not to enter wallet credentials on any site lacking a valid TLS certificate or that is not part of the official Trezor ecosystem. Continuous telemetry collection from DNS and certificate monitoring is recommended to detect future re‑use of this infrastructure.