18.161.38.178
Intelligence Briefing: IP 18.161.38.178
Infrastructure & Ownership:
The endpoint 18.161.38.178 was identified as an Amazon Web Services (CloudFront) infrastructure node operated by Amazon.com, Inc. (ASN 16509). The host served HTTP and HTTPS services, returning a 403 Forbidden status code during observation. TLS certificate analysis linked the address to Samsung Electronics domains (file.samsungcloud.com).
Threat Assessment:
The asset registered a Low Risk reputation score of 25. No active attack indicators, honeypot hits, or known campaign associations were detected. The IP was listed on one of eight total DNSBLs. Behavioral analysis showed no WAF violations or enumeration strikes.
Anomalies & Validation:
Geolocation validation presented contradictions, with primary data locating the host in Boston, US, while the TLS certificate claimed a South Korean origin. Coherence analysis flagged mixed signals due to these discrepancies.
Recommendation:
Monitoring is recommended at Low Severity. While the asset is categorized as a Web Server with minimal immediate threat, the presence of signal contradictions warrants observation for potential configuration changes or abuse shifts.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amazon.com, Inc. |
| ASN | AS16509 |
| Network Name | AMAZON-CF |
| CIDR Block | 18.160.0.0/15 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | server-18-161-38-178.bos50.r.cloudfront.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | server-18-161-38-178.bos50.r.cloudfront.net |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | 1/2 domains |
| DMARC | 2/2 domains |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Present |
| Domains Checked | 2 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | CloudFront |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | *.file.samsungcloud.comfile.samsungcloud.com |
| Valid From | 2026-03-13T00:00:00+00:00 |
| Valid Until | 2026-09-27T23:59:59+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_128_GCM_SHA256 |
| Signature Algorithm | sha256RSA |
| Validity Period | 198 days |
| Serial Number | 00D862EF9A69695BA0FD60DD8B46DE2609 |
| Thumbprint | 910A849CEA7A2DC002CCE864262EA79C21646FD8 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 35% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 33% | 2 | 4 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 1 |
| geolocation | 13% | 1 | 1 |
| Overall | 22% | 9 | 13 |
| Data Coherence | Mixed Signals (68%) — 2 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
⚠ TLS certificate claims KR but primary geo says US
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-08 02:26:04 UTC |
| Last Seen | 2026-09-15 06:37:03 UTC |
| Profile Built | 2026-09-15 06:49:13 UTC |
| Data Freshness | Live |
| Signal Types | 27 |
| Total Observations | 35 |
Full dossier details are available via our API.