18.161.21.78
IP 18.161.21.78/32 was observed operating as a Web Server within the Amazon Web Services infrastructure, specifically associated with AS16509 and the AMAZON-CF network. Forward resolution confirmed the domain cloudfront.net, with PTR records identifying the host as server-18-161-21-78.bos50.r.cloudfront.net. Active services included HTTP and HTTPS on ports 80 and 443 over TCP, displaying a CloudFront server banner.
Security assessment assigned a Low Risk reputation score of 25. The address was flagged as a Suspicious Host, though no specific threat indicators or known campaigns were recorded. Control plane data indicated one DNSBL listing out of eight total lists checked. Geolocation data claimed origin in Seattle, Washington, yet RTT measurements of 15ms contradicted the claimed physical distance of 7883km.
The surrounding subnet (18.161.21.78/24) exhibited a mixed classification with an abuse density of 0.2069 and 24 identified threat siblings. Activity was recorded between September 24 and September 26, 2026. Operational analysis recommended monitoring due to signal contradictions and low confidence levels.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amazon.com, Inc. |
| ASN | AS16509 |
| Network Name | AMAZON-CF |
| CIDR Block | 18.160.0.0/15 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | server-18-161-21-78.bos50.r.cloudfront.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | server-18-161-21-78.bos50.r.cloudfront.net |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | CloudFront |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 42% | 2 | 4 |
| routing | 20% | 1 | 1 |
| services | 40% | 2 | 3 |
| ownership | 40% | 2 | 3 |
| reputation | 34% | 1 | 3 |
| geolocation | 40% | 2 | 3 |
| Overall | 36% | 10 | 17 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-24 11:34:02 UTC |
| Last Seen | 2026-09-26 16:06:23 UTC |
| Profile Built | 2026-09-26 16:14:48 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 27 |
Full dossier details are available via our API.