18.239.176.149
The IP address 18.239.176.149 was identified as a low-risk host associated with Amazon.com, Inc. (ASN 16509) under the network name AMAZON-CF. Risk assessment yielded a score of 25 with a Low Risk reputation label. The system operated on ports 80 and 443, returning a CloudFront server banner and an HTTP status code of 403. DNS resolution confirmed the hostname server-18-239-176-149.bos50.r.cloudfront.net with valid SPF and DMARC records.
Geolocation data indicated Boston, US, but physical validation flagged a contradiction between the claimed distance and RTT physics measurements. The control plane analysis showed the address belonged to the 18.239.176.0/24 subnet, classified as mostly_clean with an abuse density of 0.1111. Two threat siblings were observed within the neighborhood. No active campaigns, blacklists, or known attacker indicators were associated with the IP.
Behavioral analysis recorded no enumeration strikes or honeypot hits. Due to signal contradictions regarding geolocation and RTT, the recommended action was to monitor the asset for changes with low severity.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amazon.com, Inc. |
| ASN | AS16509 |
| Network Name | AMAZON-CF |
| CIDR Block | 18.238.0.0/15 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | server-18-239-176-149.bos50.r.cloudfront.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | server-18-239-176-149.bos50.r.cloudfront.net |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | CloudFront |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | *.cloudfront.netcloudfront.net |
| Valid From | 2026-08-25T00:00:00+00:00 |
| Valid Until | 2027-03-10T23:59:59+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_128_GCM_SHA256 |
| Signature Algorithm | sha256RSA |
| Validity Period | 197 days |
| Serial Number | 015E89F2D093DD92CD82A78C09A033C6 |
| Thumbprint | 5E9C8C0323F32C16F1D3F82DAE8E8E2D88E96056 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 27% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 33% | 2 | 4 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 2 |
| geolocation | 43% | 2 | 5 |
| Overall | 26% | 10 | 18 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-07 16:45:57 UTC |
| Last Seen | 2026-09-18 00:12:01 UTC |
| Profile Built | 2026-09-18 00:20:35 UTC |
| Data Freshness | Live |
| Signal Types | 25 |
| Total Observations | 33 |
Full dossier details are available via our API.