18.238.4.28
Intellectual Property Intelligence Briefing: 18.238.4.28/32
Classification: Infrastructure / CDN (CloudFront)
Ownership: Amazon.com, Inc. (ASN 16509, AMAZON-CF)
Status: Live (Last Seen: 2026-09-08)
Summary:
The target IP was identified as a web server operating within the Amazon CloudFront infrastructure. The profile assigned a Low Risk reputation with a risk score of 20. No known campaigns, abuse reports, or malicious indicators were associated with the address.
Technical Observations:
* Network Services: TCP ports 80 (HTTP) and 443 (HTTPS) were open. The server banner identified as CloudFront.
* DNS: Forward resolution confirmed `server-18-238-4-28.phl51.r.cloudfront.net`. DNS hygiene scored 80 (Excellent) with SPF and DMARC configured.
* Geolocation: Reported as Philadelphia, US. However, geolocation validation recorded a contradiction between the claimed distance (7625.7km) and measured RTT (27ms).
* Routing: Route stability flagged as false; RPKI state invalid.
Threat Assessment:
* Blacklist Status: Clean (0 lists).
* Behavioral: No honeypot hits, WAF violations, or enumeration strikes observed.
* Neighborhood: Classification marked as clean with 0 abuse density.
Recommendation:
Monitor for changes in signal contradiction regarding geolocation and RTT data. Current severity is Low. Standard operational monitoring is advised for this infrastructure asset.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amazon.com, Inc. |
| ASN | AS16509 |
| Network Name | AMAZON-CF |
| CIDR Block | 18.238.0.0/15 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | server-18-238-4-28.phl51.r.cloudfront.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | server-18-238-4-28.phl51.r.cloudfront.net |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | CloudFront |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 29% | 2 | 2 |
| routing | 17% | 1 | 1 |
| services | 17% | 1 | 1 |
| ownership | 35% | 2 | 3 |
| reputation | 21% | 1 | 2 |
| geolocation | 17% | 1 | 1 |
| Overall | 23% | 8 | 10 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-02 14:05:07 UTC |
| Last Seen | 2026-09-08 12:34:41 UTC |
| Profile Built | 2026-09-08 12:51:53 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 26 |
Full dossier details are available via our API.