production-gb-vjson[.]s3[.]us-east-1[.]amazonaws[.]com

The domain production-gb-vjson.s3.us-east-1.amazonaws.com is actively used in a high‑risk brand‑impersonation campaign targeting Adobe. Infrastructure analysis shows the hostname resolves to 16.182.39.194, an Amazon‑owned address (AS16509, United States). The server presents an Amazon RSA 2048 M01 certificate and returns HTTP 403 for direct requests. DNS is hosted on four AWS name‑servers (ns‑1106.awsdns‑10.org, ns‑1567.awsdns‑03.co.uk, ns‑479.awsdns‑59.com, ns‑537.awsdns). The domain appears on two public phishing blocklists (PhishDestroy, PhishingDB) and carries a Gridinsoft trust score of 0 / 100. VirusTotal records 9 of 95 scanners flagging the host, confirming malicious activity. The site is classified as an E‑Commerce scam and is specifically flagged for Adobe brand impersonation. No page‑content analysis is available, so the exact payload and user‑facing behavior remain unknown. Defenders should block DNS resolution and HTTP traffic to the domain and its associated IP, add the domain to threat‑intel feeds, and monitor for related AWS S3 sub‑domains. Ongoing observation is recommended to detect any infrastructure changes.