18.161.21.76
IP address 18.161.21.76 was classified as a low-risk host with an assigned reputation score of 25. Ownership records indicate the address belongs to Amazon.com, Inc. (AS16509), specifically within the AMAZON-CF network block (18.160.0.0/15). The infrastructure operates as a Web Server with CloudFront branding, responding on ports 80 and 443. Forward DNS resolution confirmed the hostname server-18-161-21-76.bos50.r.cloudfront.net.
Threat intelligence feeds did not flag the address as a known attacker, spam source, or Tor exit node, though the threat actor classification is listed as Suspicious Host. Blacklist enumeration returned zero specific matches, but the address appeared on one DNS blacklist out of eight total checks. Geolocation data presented contradictions; while attributed to Washington, US, Round Trip Time (RTT) measurements indicated a physical distance violation against the reported location. The neighborhood classification for the /24 subnet remains mostly_clean with an abuse density of 0.1619.
Operational analysis recommends monitoring the address due to signal contradictions present in the geolocation validation and the Suspicious Host classification, despite the low overall risk profile.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amazon.com, Inc. |
| ASN | AS16509 |
| Network Name | AMAZON-CF |
| CIDR Block | 18.160.0.0/15 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | server-18-161-21-76.bos50.r.cloudfront.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | server-18-161-21-76.bos50.r.cloudfront.net |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | 2/2 domains |
| DMARC | 2/2 domains |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Present |
| Domains Checked | 2 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | CloudFront |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 37% | 2 | 8 |
| routing | 13% | 1 | 1 |
| services | 27% | 2 | 4 |
| ownership | 27% | 2 | 3 |
| reputation | 27% | 1 | 5 |
| geolocation | 33% | 2 | 6 |
| Overall | 27% | 10 | 27 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-05 03:46:21 UTC |
| Last Seen | 2026-09-26 21:14:34 UTC |
| Profile Built | 2026-09-26 21:26:55 UTC |
| Data Freshness | Live |
| Signal Types | 25 |
| Total Observations | 52 |
Full dossier details are available via our API.