ec2-35-170-63-110[.]compute-1[.]amazonaws[.]com

The domain ec2-35-170-63-110.compute-1.amazonaws.com was observed resolving to the IP address 35.170.63.110, an Amazon Web Services host located in the United States and announced by ASN 14618 (Amazon.com, Inc.). The domain was created on August 18, 2005 and is served by the AWS‑provided nameservers ns-1321.awsdns-37.org, ns-1670.awsdns-16.co.uk, ns-27.awsdns-03.com and ns-967.awsdns-. No SSL certificate is presented for the site, indicating that the service was delivered over plain HTTP at the time of collection.

A page title retrieved from the endpoint reads “Sign in with myGov - myGov”, directly referencing the Australian Government’s myGov portal, confirming a brand‑impersonation attempt aimed at Australian citizens. VirusTotal recorded 13 detections out of 93 scanning engines, and the domain is listed on a single external blocklist; it has also been flagged by the PhishDestroy service. The campaign status is currently offline, suggesting the malicious content has been removed or the hosting instance terminated.

Defenders should incorporate the observed IP address and fully qualified domain name into network‑level denial lists, enforce TLS inspection to detect the absence of encryption, and update URL filtering rules to block any future resolution of this host. Continuous monitoring of AWS‑owned address ranges for similar anomalous HTTP services targeting Australian government credentials is advisable, as is periodic re‑scanning of the domain should it reappear. The lack of an SSL certificate and the use of a generic EC2 hostname are consistent with opportunistic phishing infrastructure, but the precise content and any associated payloads remain unverified because the site is no longer reachable.