faqt[.]d3jkuytm1azvyq[.]amplifyapp[.]com

Analysis of the domain faqt.d3jkuytm1azvyq.amplifyapp.com indicates it is a confirmed seed-phishing site impersonating Trezor, a cryptocurrency hardware wallet provider. The domain was flagged by PhishDestroy and holds a Gridinsoft trust score of 0/100, reflecting high-risk classification. It appears on at least one security blocklist and was taken offline following detection. The page title, 'Trezor Suite,' directly matches the legitimate Trezor software interface, aligning with the identified 'Seed Phrase Phishing' kit used in this campaign.

Infrastructure analysis reveals the domain is hosted on Amazon Web Services (AS16509) in Germany, resolving to IP 3.160.150.26. No SSL certificate was present, increasing the likelihood of interception or tampering. Google Safe Browsing classified the site as engaging in social engineering, a common tactic in cryptocurrency phishing schemes. The domain was registered through NOM-IQ Ltd dba Com Laude on April 17, 2018, though this registration predates the phishing activity by several years, suggesting potential compromise or repurposing of an older domain.

Nameservers are hosted under AWS (awsdns-17.org, awsdns-18.co.uk, awsdns-21.com, awsdns-56.net), consistent with cloud-based phishing infrastructure. While VirusTotal shows minimal vendor detection (1 of 95), this does not diminish the confirmed threat, as phishing domains often evade initial scans. Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels. Users who interacted with the site should assume their seed phrases or credentials were compromised and take immediate steps to secure their wallets, including revoking access to any connected applications and transferring assets to a new, verified wallet address.