tcw[.]d2htu21ngnuv7l[.]amplifyapp[.]com

The domain tcw.d2htu21ngnuv7l.amplifyapp.com was created on April 17, 2018 and is currently listed as offline. Infrastructure analysis shows it resolves to the IPv4 address 18.245.31.38, which is assigned to Amazon.com, Inc. (AS16509) and geolocated to Germany. The authoritative name servers are ns-1165.awsdns-17.org, ns-1683.awsdns-18.co.uk, ns-169.awsdns-21.com, and ns-904.awsdns, confirming that the site was hosted on Amazon Web Services. No TLS certificate was observed, meaning the site served HTTP only, a characteristic that reduces transport‑layer trust.

The registrar record indicates registration through NOM-IQ Ltd dba Com Laude, and the site appears on a single security blocklist, PhishDestroy, which has already flagged it as malicious. Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence in its malicious nature. The page title returned from the host is "Trezor Suite," and the domain explicitly impersonates the Trezor brand, aligning with the documented scam type of wallet or seed phrase phishing. Malware analysis tools identified the use of a Seed Phrase Phishing kit, which is commonly employed to harvest cryptocurrency recovery seeds.

VirusTotal scans reported that two of ninety‑five security vendors flagged the domain, providing additional corroboration of its malicious intent. Defenders should block the domain and its resolved IP at perimeter firewalls, update internal URL filtering lists with the observed hostnames, and monitor for any re‑use of the associated AWS infrastructure. Given the absence of a valid SSL certificate and the low trust score, any attempt to interact with this host is likely to result in credential theft. Continuous observation of the registrar and name‑server changes is advised, as threat actors may repurpose the same registration details for future campaigns.