Domain
api.aws
Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.
Run a live full scan of api.aws
On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.
Hosting IPs
46,598
A/AAAA targets
Subdomains
24,815
CT + scan + body
Record Types
1
seen in DNS
Observed Certs
—
in our scans
DNS Records
A
—
AAAA
—
MX
—
NS
ns-1471.awsdns-55.org, ns-1805.awsdns-33.co.uk, ns-225.awsdns-28.com, ns-662.awsdns-18.net
TXT
—
CNAME
—
CAA
—
WHOIS / Registration
Registration data planned
Registrar, creation/expiry dates and domain status via RDAP. Rolling out gradually — bulk WHOIS is rate-limited, so we resolve on a prioritized cadence.
Subdomains
Every subdomain we know about — harvested from CT-log SANs, scan-observed certs and HTML body references — paired with its current A/AAAA target.
Tech Stack
Tech detection pending
Wappalyzer-rules detect CMS, frameworks, analytics, JS libs and server-side languages on this domain.
TLS Certificates
Subject: *.ec2-instance-connect-endpoint.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: *.2ef6b67f.ec2-instance-connect-endpoint.us-gov-west-1.api.aws, *.ec2-instance-connect-endpoint.us-gov-west-1.api.aws
Subject: application-signals-gamma.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: *.application-signals-gamma.us-gov-west-1.vpce.amazonaws.com, application-signals-gamma.us-gov-west-1.api.aws
Subject: s3vectors.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: *.s3vectors.us-gov-west-1.vpce.amazonaws.com, s3vectors.us-gov-west-1.api.aws
Subject: lb-c01-osu62.eks-auth.us-gov-east-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: *.eks-auth.us-gov-east-1.vpce.amazonaws.com, eks-auth-fips.us-gov-east-1.api.aws, eks-auth.us-gov-east-1.api.aws, lb-c01-osu62.eks-auth.us-gov-east-1.api.aws, osu62.eks-auth.us-gov-east-1.api.aws
Subject: topology.application-signals-staging-fips.us-gov-east-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: topology.application-signals-staging-fips.us-gov-east-1.api.aws
Subject: lambda.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: *.api-lambda.us-gov-west-1.api.aws, lambda.us-gov-west-1.api.aws
Subject: lambda.us-gov-east-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: *.api-lambda.us-gov-east-1.api.aws, lambda.us-gov-east-1.api.aws
Subject: gamma-notifications.ap-southeast-3.api.aws
Issuer: Amazon RSA 2048 M04
SANs: *.gamma-notifications.ap-southeast-3.vpce.amazonaws.com, gamma-notifications.ap-southeast-3.amazonaws.com, gamma-notifications.ap-southeast-3.api.aws
Subject: s3-hrs-syd.ap-southeast-2.api.aws
Issuer: Amazon RSA 2048 M04
SANs: s3-hrs-syd.ap-southeast-2.api.aws
Subject: lambda.us-east-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: *.api-lambda.us-east-1.api.aws, lambda.us-east-1.api.aws
Subject: application-signals-staging.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: *.application-signals-staging.us-gov-west-1.vpce.amazonaws.com, application-signals-staging.us-gov-west-1.api.aws
Subject: s3-hrs-osu.us-gov-east-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: s3-hrs-osu.us-gov-east-1.api.aws
Subject: ecncontroller-rms-1.us-gov-east-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: ecncontroller-rms-1.us-gov-east-1.api.aws
Subject: emr-service-cell01.us-gov-east-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: *.emr-service-cell01.us-gov-east-1.vpce.amazonaws.com, emr-service-cell01.us-gov-east-1.api.aws
Subject: workspaces-instances-gamma.me-central-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: workspaces-instances-gamma.me-central-1.api.aws
Subject: us-gov-west-1.gamma.fips.frontend.cloudapi.aws.dev
Issuer: Amazon RSA 2048 M04
SANs: us-gov-west-1.gamma.fips.frontend.cloudapi.aws.dev
Subject: centaur-gamma.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: centaur-gamma.us-gov-west-1.api.aws
Subject: *.cell-0-sync-invoke-service-lambda.me-central-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: *.cell-0-sync-invoke-service-lambda.me-central-1.api.aws
Subject: topology.application-signals.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: topology.application-signals.us-gov-west-1.api.aws
Subject: *.fips.ec2-instance-connect-endpoint.us-gov-east-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: *.c8334461.fips.ec2-instance-connect-endpoint.us-gov-east-1.api.aws, *.fips.ec2-instance-connect-endpoint.us-gov-east-1.api.aws
Subject: centaur-gamma-fips.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: centaur-gamma-fips.us-gov-west-1.api.aws
Subject: *.fips.ec2-instance-connect-endpoint.us-gov-east-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: *.c8334461.fips.ec2-instance-connect-endpoint.us-gov-east-1.api.aws, *.fips.ec2-instance-connect-endpoint.us-gov-east-1.api.aws
Subject: miapi.awsapp.cn
Issuer: Amazon RSA 2048 M01
SANs: miapi.awsapp.cn
Subject: redshift-data-integ.us-gov-east-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: *.integ.redshift-data.us-gov-east-1.vpce.amazonaws.com, *.redshift-data-integ.us-gov-east-1.api.aws, redshift-data-integ.us-gov-east-1.api.aws
Subject: athena.us-gov-east-1.api.aws
Issuer: Amazon RSA 2048 M04
SANs: athena.us-gov-east-1.api.aws
Subject: application-signals-gamma.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: *.application-signals-gamma.us-gov-west-1.vpce.amazonaws.com, application-signals-gamma.us-gov-west-1.api.aws
Subject: application-signals-gamma.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: *.application-signals-gamma.us-gov-west-1.vpce.amazonaws.com, application-signals-gamma.us-gov-west-1.api.aws
Subject: *.ec2-instance-connect-endpoint.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: *.2ef6b67f.ec2-instance-connect-endpoint.us-gov-west-1.api.aws, *.ec2-instance-connect-endpoint.us-gov-west-1.api.aws
Subject: redshift-data-integ.me-central-1.api.aws
Issuer: Amazon RSA 2048 M02
SANs: *.integ.redshift-data.me-central-1.vpce.amazonaws.com, *.redshift-data-integ.me-central-1.api.aws, redshift-data-integ.me-central-1.api.aws
Subject: runtime-v2-lex-gamma.us-gov-west-1.api.aws
Issuer: Amazon RSA 2048 M01
SANs: runtime-v2-lex-gamma.us-gov-west-1.api.aws
IPs Citing This Domain
No citing IPs found yet
As the world-sweep progresses, hosts referencing this domain in their HTML will surface here.
Origin / IP-Leak
USP
When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.
| Origin IP | Origin ASN | CDN ASN | Confidence | Reasoning |
|---|---|---|---|---|
| 96.114.222.63 | AS7922 | AS16509 | 95% | cert 4cd2a96e… served by 96.114.222.63 (AS7922) carries SAN kinesis-fips.us-east-1.api.aws which currently resolves through Amazon (AS16509) at 44.220.67.135, 2600:1f70:8000:111:3bee:c21a:1fbd:405f, 44.215.76.149, 2600:1f70:8000:140:fd8b:3cf6:cc6a:a0fb |
| 72.13.122.5 | AS53334 | AS16509 | 95% | cert 4cd2a96e… served by 72.13.122.5 (AS53334) carries SAN kinesis-fips.us-east-1.api.aws which currently resolves through Amazon (AS16509) at 44.215.76.149, 2600:1f70:8000:140:fd8b:3cf6:cc6a:a0fb, 44.220.67.183, 2600:1f70:8000:150:1674:94dd:8d97:e3cc |
| 96.99.165.57 | AS7922 | AS16509 | 95% | cert aa50fd8e… served by 96.99.165.57 (AS7922) carries SAN kinesis-fips.us-east-1.api.aws which currently resolves through Amazon (AS16509) at 44.220.67.183, 2600:1f70:8000:150:1674:94dd:8d97:e3cc, 44.220.67.135, 2600:1f70:8000:140:adfb:1c9f:1dd:2dfc |
| 184.120.33.26 | AS212465 | AS16509 | 95% | cert 251b9e7a… served by 184.120.33.26 (AS212465) carries SAN ssmmessages.eu-west-1.api.aws which currently resolves through Amazon (AS16509) at 3.253.226.78, 2a05:d03a:8000:40:b389:b9b6:1c24:7832, 3.253.218.175, 2a05:d03a:8000:80:55a3:df24:5d20:daf7 |
| 96.194.7.214 | AS7922 | AS16509 | 95% | cert 07e8f351… served by 96.194.7.214 (AS7922) carries SAN ssm.us-east-2.api.aws which currently resolves through Amazon (AS16509) at 3.146.13.158, 2600:1f70:6000:80:e753:d000:35b7:3428, 3.146.12.87, 2600:1f70:6000:40:72c4:8678:6233:4d8e |
| 96.104.23.18 | AS7922 | AS16509 | 95% | cert ee99a181… served by 96.104.23.18 (AS7922) carries SAN ssm.us-east-1.api.aws which currently resolves through Amazon (AS16509) at 44.216.184.189, 2600:1f70:8000:a1:2f73:bb88:7c90:1528, 13.220.37.186, 2600:1f70:8000:60:aba2:53f3:ad7c:13e7 |
| 96.103.137.246 | AS7922 | AS16509 | 95% | cert ee99a181… served by 96.103.137.246 (AS7922) carries SAN ssm.us-east-1.api.aws which currently resolves through Amazon (AS16509) at 44.216.184.189, 2600:1f70:8000:a1:2f73:bb88:7c90:1528, 13.220.37.186, 2600:1f70:8000:60:aba2:53f3:ad7c:13e7 |
| 96.104.23.18 | AS7922 | AS14618 | 95% | cert ee99a181… served by 96.104.23.18 (AS7922) carries SAN ssm.us-east-1.api.aws which currently resolves through Amazon (AS14618) at 2600:1f70:8000:60:aba2:53f3:ad7c:13e7, 13.217.78.180, 2600:1f70:8000:21:3f22:95dc:9746:d25a, 44.216.200.77 |
Threat Intelligence
Domain threat-intel pending
Matches in URLhaus, OpenPhish, PhishTank, malware feeds, and Spamhaus DBL.
History
Passive DNS — every value this name ever resolved to and when we first / last observed it. Updates every cycle of our forward-DNS crawler.
| Type | Value | First seen | Last seen |
|---|---|---|---|
| NS | ns-1471.awsdns-55.org | 2026-06-01 19:43:46.544 | 2026-07-15 20:04:13.980 |
| NS | ns-662.awsdns-18.net | 2026-06-01 19:43:46.544 | 2026-07-15 20:04:13.980 |
| NS | ns-225.awsdns-28.com | 2026-06-01 19:43:46.544 | 2026-07-15 20:04:13.980 |
| NS | ns-1805.awsdns-33.co.uk | 2026-06-01 19:43:46.544 | 2026-07-15 20:04:13.980 |