hub-nanoeth[.]net

This domain, hub-nanoeth.net, is actively impersonating Amazon Web Services (AWS) as part of a high-risk phishing campaign. Analysis indicates the site uses the page title 'Cloud Computing Services - Amazon Web Services (AWS)', directly targeting users of AWS services. The domain was registered on October 19, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 13.33.67.57. Infrastructure analysis reveals the use of Cloudflare, HTTP/3, and third-party resources such as Chart.js and jsDelivr, which may facilitate the delivery of malicious payloads or credential harvesting scripts. Security vendors have flagged this domain, with 19 out of 95 detecting it as malicious. It appears on three security blocklists and is blocked by at least three major threat intelligence feeds, including SEAL, MetaMask, and PhishDestroy. AlienVault OTX lists the domain in four threat intelligence pulses, further confirming its association with malicious activity. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy due to the prevalence of free and automated certificate issuance. Defenders should treat this domain as a confirmed phishing threat targeting AWS credentials or related sensitive information. Immediate action is recommended, including blocking the domain at the DNS or proxy level, updating endpoint protection rules, and monitoring for connections to the associated IP address. The domain remains active as of July 12, 2026, and further analysis of its content or payloads is advised to determine the full scope of the threat. No evidence of a specific phishing kit or additional technical artifacts is currently available, but the combination of brand impersonation, active blocklisting, and third-party detections justifies high-risk classification.