faql[.]d215b7kl5ui49j[.]amplifyapp[.]com

The domain faql.d215b7kl5ui49j.amplifyapp.com is currently listed as offline but retains a set of observable artifacts that indicate a deliberate brand‑impersonation campaign targeting Ledger users. DNS resolution points to the IPv4 address 3.162.3.48, which is allocated to Amazon.com, Inc. (AS16509) and geolocated in Canada. The domain lacks any TLS certificate, meaning that HTTPS connections would be unencrypted if the site were reachable. Reputation scoring from Gridinsoft registers a zero out of one hundred, reflecting a total lack of trust.

The registrar entry shows the domain was created on 17 April 2018 and is registered through NOM‑IQ Ltd operating as Com Laude, a detail that aligns with other malicious infrastructure observed from the same registrar. Four authoritative name servers are listed: ns-1165.awsdns-17.org, ns-1683.awsdns-18.co.uk, ns-169.awsdns-21.com, and ns-904.awsdns, all of which belong to Amazon’s Route 53 service, confirming that the hosting environment is a generic cloud platform rather than a bespoke malicious hosting provider. Security‑vendor scans on VirusTotal reveal that nine out of ninety‑five AV engines flag the domain, and it appears on a single external blocklist, indicating that while detection is not universal, there is measurable consensus about its malicious nature.

The site is also recorded as blocked by the PhishDestroy mitigation service, reinforcing the view that defensive communities have taken action against it. The page title reported for the site is "Ledger Live," directly mirroring the official Ledger application interface and confirming the intent to impersonate the brand. The threat classification is listed as a crypto scam, matching the known pattern of credential‑stealing or fund‑exfiltration campaigns that lure victims with counterfeit Ledger login portals.