18.239.168.95
Intelligence Briefing: 18.239.168.95/32
Overview
The IP address 18.239.168.95 was classified as Low Risk with a risk score of 25. Ownership was attributed to Amazon.com, Inc. (AS16509) under the AMAZON-CF network, specifically the AMAZON-CF CIDR block 18.238.0.0/15. The network role was identified as a Web Server operating on a CloudFront infrastructure.
Technical Observations
Analysis confirmed standard web services on TCP ports 80 and 443. The server banner identified the service as "CloudFront." DNS records were forward confirmed for cloudfront.net with valid PTR hostnames. DNS hygiene was rated Excellent, with SPF, DMARC, and CAA records present. The asset was observed in the 18.239.168.0/24 subnet, where the neighborhood classification was mostly clean.
Threat Assessment
No known campaigns, blacklist hits, or active attacker indicators were detected during the observation window. The asset was not flagged as a Tor exit node or proxy. However, the system labeled the host as "Suspicious" due to signal inconsistencies. Specifically, geolocation data placed the server in Boston, US, while Round Trip Time physics measurements indicated a distance of 7625km against a latency of 16ms, creating a contradiction.
Recommendation
The recommended action was to Monitor the asset due to signal contradictions, with a severity rating of Low. No immediate firewall rules were required.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amazon.com, Inc. |
| ASN | AS16509 |
| Network Name | AMAZON-CF |
| CIDR Block | 18.238.0.0/15 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | server-18-239-168-95.bos50.r.cloudfront.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | server-18-239-168-95.bos50.r.cloudfront.net |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | 2/2 domains |
| DMARC | 2/2 domains |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Present |
| Domains Checked | 2 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | CloudFront |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 43% | 2 | 5 |
| routing | 13% | 1 | 1 |
| services | 33% | 2 | 4 |
| ownership | 27% | 2 | 3 |
| reputation | 28% | 1 | 3 |
| geolocation | 33% | 2 | 4 |
| Overall | 29% | 10 | 20 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-03 06:49:55 UTC |
| Last Seen | 2026-09-23 12:07:03 UTC |
| Profile Built | 2026-09-23 12:16:29 UTC |
| Data Freshness | Live |
| Signal Types | 24 |
| Total Observations | 37 |
Full dossier details are available via our API.