diff --git a/internal/classify/aws.go b/internal/classify/aws.go
index 568289a..3c94297 100644
--- a/internal/classify/aws.go
+++ b/internal/classify/aws.go
@@ -25,10 +25,12 @@ func classifyCloudFront(s *scanner) (model.Match, bool) {
 	if n != 3 || s.label(n-1) != "net" || s.label(n-2) != "cloudfront" {
 		return model.Match{}, false
 	}
+	// CloudFront distributions are CDN endpoints, not buckets or databases, so
+	// they are identified but not stored as findings.
 	return model.Match{
 		Provider:         model.ProviderAWS,
 		Service:          model.ServiceWebApp,
-		ResourceSpecific: true,
+		ResourceSpecific: false,
 		PublicSemantic:   model.PublicSemanticPublicEndpoint,
 		Resource:         s.label(0),
 	}, true
@@ -113,11 +115,13 @@ func classifyAWSS3(s *scanner) (model.Match, bool) {
 		}
 	}
 
-	// Multi-region access point: <res>.mrap.accesspoint.s3-global.amazonaws.com
+	// Multi-region access point aliases (<alias>.mrap.accesspoint.s3-global...) are
+	// AWS-generated and appear in CT in enormous volume. They are not customer
+	// bucket names, do not resolve publicly, and were flooding the pipeline, so
+	// they are deliberately not treated as findings.
 	if n >= 6 && s.label(n-5) == "mrap" && s.label(n-4) == "accesspoint" &&
 		s.label(n-3) == "s3-global" {
-		return aws(model.ProviderAWS, model.ServiceS3,
-			model.PublicSemanticNone, s.label(0), ""), true
+		return model.Match{}, false
 	}
 
 	// S3 Express: <bucket>.s3express-<zone>.<region>.amazonaws.com
diff --git a/internal/classify/classify_test.go b/internal/classify/classify_test.go
index dbc3782..41f00b8 100644
--- a/internal/classify/classify_test.go
+++ b/internal/classify/classify_test.go
@@ -59,7 +59,6 @@ func TestClassifyMatches(t *testing.T) {
 		{"ap-123456.s3-accesspoint.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "ap-123456", "us-east-1", true, 0}},
 		{"x.s3-accesspoint.dualstack.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "us-east-1", true, 0}},
 		{"x.s3-accesspoint-fips.us-east-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "us-east-1", true, 0}},
-		{"x.mrap.accesspoint.s3-global.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "x", "", true, 0}},
 		{"bucket.s3express-zone1.eu-west-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "bucket", "eu-west-1", true, 0}},
 		{"bucket-01.s3-eu-west-1.amazonaws.com", want{model.ProviderAWS, model.ServiceS3, "bucket-01", "eu-west-1", true, 0}},
 		// AWS databases
@@ -94,7 +93,7 @@ func TestClassifyMatches(t *testing.T) {
 		{"project.firebaseio.com", want{model.ProviderGCP, model.ServiceFirebaseDB, "project", "", true, 0}},
 		{"project.europe-west1.firebasedatabase.app", want{model.ProviderGCP, model.ServiceFirebaseDB, "project", "europe-west1", true, 0}},
 		{"myproject.appspot.com", want{model.ProviderGCP, model.ServiceWebApp, "myproject", "", true, 0}},
-		{"d111111abcdef8.cloudfront.net", want{model.ProviderAWS, model.ServiceWebApp, "d111111abcdef8", "", true, model.PublicSemanticPublicEndpoint}},
+		{"d111111abcdef8.cloudfront.net", want{model.ProviderAWS, model.ServiceWebApp, "d111111abcdef8", "", false, model.PublicSemanticPublicEndpoint}},
 		// Cloudflare
 		{"acct.r2.cloudflarestorage.com", want{model.ProviderCloudflare, model.ServiceObjectStorage, "acct", "", true, 0}},
 		{"mybucket.r2.dev", want{model.ProviderCloudflare, model.ServiceObjectStorage, "mybucket", "", true, model.PublicSemanticPublicURL}},
@@ -138,6 +137,7 @@ func TestClassifyRejects(t *testing.T) {
 		"cache.amazonaws.com",
 		"use1.cache.amazonaws.com",
 		"s3-global.amazonaws.com",
+		"x.mrap.accesspoint.s3-global.amazonaws.com",
 		// Azure bare service endpoints
 		"blob.core.windows.net",
 		"database.windows.net",