cbx-zone[.]s3[.]ap-southeast-5[.]amazonaws[.]com

The domain cbx-zone.s3.ap-southeast-5.amazonaws.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting Amazon. Infrastructure analysis shows the domain resolves to IP 16.12.43.26, which is hosted in Malaysia under ASN 16509 (Amazon.com, Inc.). Registration records indicate the domain was created on 21 February 2026 and was obtained through MarkMonitor, Inc. The associated SSL certificate is issued to Amazon and uses the Amazon RSA 2048 M01 profile, confirming the use of Amazon Certificate Manager. Nameserver delegation contains ns‑1321.awsdns-37.org, ns‑1670.awsdns-16.co.uk, ns‑27.awsdns-03.com, among others, reflecting standard AWS DNS configuration. Detected technologies include Amazon Web Services, Amazon S3 storage, and AWS Certificate Manager. An HTTP request returns a 403 status, suggesting restricted access to the underlying object. Threat intelligence shows one of ninety‑three VirusTotal scanners flagged the domain, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist. It is already blocked by PhishDestroy. The page title returned is “CBX,” but no further content analysis is available. Defenders should immediately block the domain at network perimeters, add it to local threat‑intelligence feeds, and monitor for related AWS‑hosted indicators. Continuous surveillance of associated IP ranges and AWS resource identifiers is recommended to detect any expansion of the campaign.