d259p54wqxi9ep[.]cloudfront[.]net

Analysis indicates the domain d259p54wqxi9ep.cloudfront.net is currently active and classified as a generic phishing infrastructure. Google Safe Browsing lists it under SOCIAL_ENGINEERING, and 15 of 91 security vendors on VirusTotal have flagged it, suggesting a consensus of malicious intent. DNS resolution points to IP 18.172.111.228, which geolocates to Germany and is associated with a large cloud provider's autonomous system (AS16509). The domain uses a standard 2048‑bit RSA certificate issued to a major cloud operator. Nameserver delegation includes ns-1306.awsdns-35.org, ns-1597.awsdns-07.co.uk, and ns-418.awsdns-52.com, confirming use of the provider's DNS service. Registration was performed through a trademark monitoring service, a pattern often seen in abuse campaigns. The site returns HTTP 403, indicating restricted access, and receives a trust score of 0/100 from a security product. It is listed on at least one blocklist and is actively blocked by PhishDestroy. While the exact content served has not been captured, the combination of Google Safe Browsing labeling, vendor detections, and blocklist inclusion provides strong evidence of phishing use. Defenders should block outbound connections to the resolved IP and add the domain to URL filtering rules. Continuous monitoring of DNS changes and any new content served is advised, and incident response teams should treat any user‑reported interactions with this domain as compromised.