amzn-gong[.]s3[.]us-east-2[.]amazonaws[.]com

Analysis indicates that the subdomain amzn-gong.s3.us-east-2.amazonaws.com was registered on May 14, 2026 and resolves to the IP address 3.5.88.35, which is identified as an AWS EC2 instance in the us-east-2 region of the United States. The domain is hosted on Amazon S3 infrastructure and presents an SSL certificate issued to "Amazon / Amazon RSA 2048 M01", which may be used to lend legitimacy to malicious traffic. HTTP requests return a 403 status, preventing content retrieval, and no page content has been observed; therefore the exact payload or lure employed by the actor remains unknown. Threat intelligence flags the domain as a brand‑impersonation campaign targeting Amazon, with Google Safe Browsing classifying it under "SOCIAL_ENGINEERING" and PhishDestroy already listing it as blocked. VirusTotal analysis shows that 13 of 92 security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The domain is registered through MarkMonitor Inc. and appears on one external security blocklist. Defenders should immediately block DNS resolution to the host, add the IP 3.5.88.35 to network deny lists, and monitor outbound connections for any attempts to contact this subdomain. Continuous monitoring of AWS S3 subdomains associated with Amazon should be instituted, and any related alerts from Google Safe Browsing or similar services should be escalated for further investigation.