dd6qg4wn9ejpd.cloudfront.net
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Description of dd6qg4wn9ejpd.cloudfront.net
This domain is a CloudFront-hosted subdomain under cloudfront.net, which suggests it is part of Amazon's content delivery infrastructure rather than a standalone branded website. Such subdomains are commonly used to distribute web content, application assets, downloads, or temporary campaign pages through a globally distributed hosting network.
Based on the domain structure and infrastructure details, the specific operator is not clearly identifiable from the hostname alone. The subdomain appears to be an automatically generated or customer-assigned CloudFront endpoint, and no clear public-facing brand, organization name, or site purpose is evident from the available scan data.
Safety Assessment for dd6qg4wn9ejpd.cloudfront.net
This domain was flagged by 11 out of 91 security engines at the time of the scan, with several classifying it as malicious or phishing-related. That level of multi-engine agreement is a meaningful warning sign, especially for a domain with no clear branding, no traffic ranking, and a hostname that appears to be an opaque CDN subdomain rather than a recognizable public website.
At the same time, not all signals were negative. The malware scan reported no flagged files, major browsing-protection data available here did not show a listing at the time of the scan, and the domain's IP was not listed on the checked mail-reputation blocklists. However, one blacklist source did list the domain with a generic malicious-object label, which adds some supporting concern even though it is less specific than a confirmed malware family or phishing kit identification.
Taken together, the strongest signal here is the relatively broad security-engine detection consensus rather than the blacklist data alone. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The domain uses a valid TLS certificate issued for Amazon infrastructure and is served through AWS CloudFront, with the observed edge location resolving to Paris, France. The web server identified itself as openresty/1.31.1.1, which is commonly used in reverse-proxy and CDN-backed deployments. The domain itself is old, having existed for roughly 18 years, but that age primarily reflects the cloudfront.net parent infrastructure and does not necessarily indicate how long this specific hosted content has been in use.
DNSSEC appears to be unsigned, which is common but means DNS responses do not benefit from DNSSEC validation. From a security perspective, the main concern is not the TLS or hosting setup, which appears standard for a major CDN, but the fact that multiple security engines flagged the URL despite otherwise ordinary infrastructure characteristics.
Share your experience with this website. Was it safe? Did you encounter any issues?