lkdjfudh0-oskdjddd11[.]s3[.]eu-north-1[.]amazonaws[.]com

This domain, lkdjfudh0-oskdjddd11.s3.eu-north-1.amazonaws.com, was flagged for brand impersonation targeting Amazon, operating as an e-commerce scam. Infrastructure analysis reveals the domain was registered on February 21, 2026, through MarkMonitor, Inc., and hosted on Amazon Web Services (AWS) S3 storage in the eu-north-1 region. It resolved to IP 3.5.217.2 (AS16509, Amazon.com, Inc., Sweden) and used AWS nameservers. The SSL certificate was issued by Amazon RSA 2048 M04, consistent with legitimate AWS infrastructure, which may have aided in evading initial detection. At the time of assessment (July 22, 2026), the domain returned an HTTP 404 status and was offline, though this does not confirm permanent takedown.

It appeared on at least one security blocklist and was blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100. VirusTotal scans detected the domain as malicious by 3 of 93 security vendors, though the absence of detections from other vendors does not imply safety. The exact content of the phishing pages is not yet analyzed, but the scam type is classified as an e-commerce fraud based on available intelligence. Defenders should treat this domain as high-risk due to its use of legitimate AWS infrastructure to impersonate a major brand.

Block the domain, its resolved IP, and associated AWS S3 bucket identifiers at network and endpoint levels. Monitor for re-activation or similar domains using AWS S3 naming patterns (e.g., random alphanumeric strings followed by s3.eu-north-1.amazonaws.com). Review logs for connections to 3.5.217.2 or requests to this domain, particularly from users who may have interacted with e-commerce-related emails or links. No further indicators of compromise (IOCs) such as payload hashes or redirect chains are available at this time.