lgggr[.]d3jcya6krt3f1x[.]amplifyapp[.]com

Analysis of the domain lgggr.d3jcya6krt3f1x.amplifyapp.com indicates it was a high-risk brand impersonation site targeting Ledger, a cryptocurrency hardware wallet provider. The domain, hosted on Amazon Web Services infrastructure (IP 13.33.88.39, AS16509, Singapore), was flagged for social engineering by Google Safe Browsing and blocked by at least one security vendor (PhishDestroy). Eleven of 93 security vendors on VirusTotal detected the domain as malicious, though the exact detection rules are not specified in available intelligence. The page title 'Ledger Live' matches Ledger's official software, suggesting an attempt to deceive users into interacting with fraudulent wallet management or recovery tools.

Infrastructure analysis reveals the domain was registered through NOM-IQ Ltd dba Com Laude on April 17, 2018, and uses AWS nameservers (ns-1165.awsdns-17.org, ns-1683.awsdns-18.co.uk, ns-169.awsdns-21.com, ns-904.awsdns). The absence of an SSL certificate further reduces trust, as legitimate Ledger services enforce HTTPS. The domain appears on one security blocklist and is classified as a crypto scam, though specific tactics (e.g., seed phrase theft, fake firmware updates) are not confirmed in available data. As of July 24, 2026, the domain is offline, but its prior activity and hosting on a cloud provider known for abuse warrant continued monitoring.

Defenders should treat this domain as malicious and prioritize blocking it at DNS and web gateway levels. Organizations handling cryptocurrency assets should alert users to verify domain authenticity before entering sensitive information, particularly for wallet-related services. If additional evidence emerges (e.g., captured phishing kits, victim reports), further analysis may clarify the exact attack vectors used. The domain's registration age and hosting on a reputable provider do not mitigate its malicious classification, as threat actors frequently exploit legitimate infrastructure for phishing campaigns.