I see connections to Amazon AWS servers, and since everyone can register servers on Amazon, how do I know if my PC communicating with a safe Amazon server, or with a server which a hacker registered?
If I search for the IP, all I can see is that it belongs to Amazon.
If a server is safe or not is impossible to say from remote, no matter if the server is hosted on AWS or not. There is no thing like a self-attestation for being safe or some trusted third party guaranteeing the safety.
Some IP ranges or domain names might have a reputation for being sufficiently safe since they are managed by a trusted party and because in the past not much attacks were associated with these IP ranges or domain names. With other ranges it might be exactly the opposite and then there is the large area of unknown reputation.
In other words: in some cases the reputation of the IP or domain might help, in many cases it doesn't. Specifically for cases like AWS there is no clear reputation. Thus one need to rely on other information, like analyzing the actual content of the communication instead of only analyzing the reputation of the communication peer.
