Why is s3.amazonaws.com transferring data?

That’s Amazon’s Simple Storage Service (thus the “S3”). There’s a lot of reasons that could be accessed, but it’s hard to say without looking at your blog’s source code.

No, that was enough.

It’s the “MyBlogLog” box on the right hand side of the page. Those avatar pictures come from s3.amazonaws.com.

How I figured this out:
Firefox.

On the page you’re curious about, right click and select “View Page Info”. This gives a box where you can see the sorts of things the given page links to and/or loads and such. In the “Media” tab, I saw a lot of references to images on amazonaws, and they all had “Avatar” in them.

To confirm, I used another Firefox trick. You probably already know about “View Page Source”. This lets you look at the source of the page. However, you may not have known that you can select/highlight some chunk of code on the page, right click and do “View Selection Source”. This shows you the source for just the piece that you highlighted. One other thing it does is that it shows you any *dynamic* source code. So if you have some chunk of code from a javascript or something that does a lot of stuff (like that MyBlogLog box), this method will show you the resulting code that is produced after the fact. No need to trace through the javascript code or anything. So highlight the text around the MyBlogLog box area, and View Selection Source on it, and there’s all the IMG tags pointing to amazonaws.