18.239.176.227
Intelligence analysts assessed IP 18.239.176.227 as a Low Risk asset with a risk score of 25. The address belonged to Amazon.com, Inc. (AS16509) under the AMAZON-CF network name, operating as a Web Server and CloudFront CDN node. Port scans identified open HTTP (80) and HTTPS (443) services. TLS certificates were issued by Amazon RSA 2048 M04 for *.cloudfront.net, and the server responded with a 403 status code.
Geolocation data assigned the host to Boston, US, but validation identified a contradiction where the claimed distance of 7625 km conflicted with an observed RTT of 12 ms, which is lower than the minimum possible 152.5 ms for that distance. The control plane showed valid RPKI state but unstable routing with five route changes in 30 days.
Threat analysis tagged the host as a Suspicious Host. While the neighborhood classification remained mixed with eight threat siblings in the /24 subnet, the overall reputation was classified as Low Risk due to the known ownership. Due to signal contradictions and mixed neighborhood activity, analysts recommended monitoring the address with low severity. No active campaigns or known attacker indicators were confirmed.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amazon.com, Inc. |
| ASN | AS16509 |
| Network Name | AMAZON-CF |
| CIDR Block | 18.238.0.0/15 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | server-18-239-176-227.bos50.r.cloudfront.net |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | server-18-239-176-227.bos50.r.cloudfront.net |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | 2/2 domains |
| DMARC | 2/2 domains |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Present |
| Domains Checked | 2 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Tier 2 — Moderate operator sophistication with routing hygiene |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | CloudFront |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | *.cloudfront.netcloudfront.net |
| Valid From | 2026-08-25T00:00:00+00:00 |
| Valid Until | 2027-03-10T23:59:59+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_128_GCM_SHA256 |
| Signature Algorithm | sha256RSA |
| Validity Period | 197 days |
| Serial Number | 015E89F2D093DD92CD82A78C09A033C6 |
| Thumbprint | 5E9C8C0323F32C16F1D3F82DAE8E8E2D88E96056 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 46% | 2 | 6 |
| routing | 30% | 3 | 4 |
| services | 37% | 2 | 6 |
| ownership | 30% | 3 | 4 |
| reputation | 28% | 1 | 3 |
| geolocation | 38% | 2 | 5 |
| Overall | 35% | 13 | 28 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-03 14:41:45 UTC |
| Last Seen | 2026-09-25 04:30:49 UTC |
| Profile Built | 2026-09-25 04:37:38 UTC |
| Data Freshness | Live |
| Signal Types | 30 |
| Total Observations | 48 |
Full dossier details are available via our API.