trzz[.]d3dgx0j13hf13f[.]amplifyapp[.]com

The domain trzz.d3dgx0j13hf13f.amplifyapp.com was observed hosting a wallet‑related credential harvesting page titled “Trezor Suite”. Infrastructure analysis shows the domain resolves to the Amazon Web Services address 13.35.202.72, which is registered to AS16509 (Amazon.com, Inc.) and geolocated in Singapore. The domain was created on 17 April 2018 and is registered through NOM‑IQ Ltd dba Com Laude, indicating a long‑standing registration that predates the observed abuse. No TLS certificate was presented, leaving the site accessible only over plain HTTP, which is consistent with many low‑effort phishing deployments.

The site employed a publicly known “Seed Phrase Phishing” kit, specifically targeting the Trezor hardware‑wallet brand, and the page title explicitly references the official Trezor Suite application, reinforcing the brand‑impersonation narrative. The domain is listed on one security blocklist and has been flagged by 12 of 93 VirusTotal scanners, reflecting moderate detection across major anti‑malware engines. Gridinsoft assigned a trust score of 0 out of 100, and the site was blocked by the PhishDestroy sinkhole, confirming that the payload has been taken offline.

Nameservers are the standard AWS set (ns-1165.awsdns-17.org, ns-1683.awsdns-18.co.uk, ns-169.awsdns-21.com, ns-904.awsdns). Defenders should immediately add the domain and its resolving IP to URL and IP blocklists, monitor for any resurgence of the same sub‑domain pattern, and enforce strict TLS inspection policies to detect unencrypted traffic to AWS‑hosted endpoints. Continuous observation of the registrar and ASN for new registrations using similar naming conventions is advised, as the long‑standing registration suggests potential reuse by threat actors.