gxu4vr8kwtirlk9[.]s3-website-us-east-1[.]amazonaws[.]com

The domain gxu4vr8kwtirlk9.s3-website-us-east-1.amazonaws.com is a phishing site that impersonates Facebook, posing a risk of brand impersonation. As of now, the site is taken offline, but it has been identified as a potential threat. The site was observed to display a page titled 'Just a moment... | captcha-metasuites.com', which could be an attempt to trick users into providing sensitive information or credentials.

The domain gxu4vr8kwtirlk9.s3-website-us-east-1.amazonaws.com was registered through MarkMonitor, Inc. on February 21, 2026. It resolves to the IP address 104.21.31.118, which is located in the US and is part of AS13335 Cloudflare, Inc. The domain has not been flagged by VirusTotal, with 0 of 95 vendors detecting it as malicious, and it is not flagged by Google Safe Browsing. However, it appears on 1 security blocklist, specifically PhishDestroy. The domain does not have an SSL certificate, which is a common indicator of a legitimate website.

If users have interacted with gxu4vr8kwtirlk9.s3-website-us-east-1.amazonaws.com, they should change their Facebook passwords immediately and enable two-factor authentication to secure their accounts. Users should also monitor their accounts for any unusual activity or signs of fraud. To help prevent further spread of this scam, users can report the domain to Facebook and other security organizations. If any financial information was compromised, users should contact their financial institutions and consider placing a fraud alert on their accounts.