s3-external-2[.]amazonaws[.]com

This domain, s3-external-2.amazonaws.com, is currently flagged as a high-risk phishing infrastructure targeting cloud storage users. Analysis indicates the domain mimics legitimate Amazon S3 endpoints, presenting a page titled 'Cloud Object Storage – Amazon S3 – Amazon Web Services' to deceive visitors. The domain was registered on May 11, 2026, through MarkMonitor Inc., and resolves to the IP address 52.217.165.43, located in the AWS us-east-1 region. While the SSL certificate is issued to Amazon under the Amazon RSA 2048 M04 authority, this does not confirm legitimacy, as certificates can be misused or spoofed in phishing operations. Infrastructure analysis reveals the domain is hosted on AWS nameservers, including ns-1321.awsdns-37.org and ns-1670.awsdns-16.co.uk, which aligns with legitimate Amazon S3 configurations. However, the domain appears on one security blocklist and is flagged by a single vendor on VirusTotal, suggesting detection is still emerging. The HTTP status code 307, indicating a temporary redirect, may be used to reroute victims to malicious payloads or credential harvesting pages. The Gridinsoft trust score of 0/100 further corroborates the domain's suspicious nature, though this metric alone does not provide conclusive evidence of intent. What remains uncertain is the exact payload or end goal of this phishing operation. The domain could be part of a broader campaign to distribute malware, harvest AWS credentials, or exfiltrate sensitive data under the guise of legitimate cloud storage interactions. Defenders should treat this domain as actively malicious and prioritize blocking it at the network level. Monitoring for connections to 52.217.165.43 or related AWS S3 endpoints with similar naming patterns is recommended. Organizations using AWS should verify any unexpected redirects or storage bucket interactions originating from this domain, as it may indicate compromise or targeted phishing attempts.