54.217.120.218
The IP address 54.217.120.218 belongs to Amazon.com, Inc. (AS16509) and is registered under the netname AMAZO-ZDUB3. It functions as a web server within Amazon Web Services infrastructure, resolving via forward DNS to ec2-54-217-120-218.eu-west-1.compute.amazonaws.com. The host runs an Apache server and exposes HTTP (port 80) and HTTPS (port 443). The TLS certificate is issued by Sectigo for the subject CN=*.samsungapps.com.
Geolocation data placed the server in Dublin, IE, although the TLS certificate indicates a South Korean origin, creating a contradiction with other geo sources. The IP currently holds a Low Risk reputation score with zero blacklist entries and no known campaigns or threat indicators. Behavioral analysis confirms no honeypot hits, enumeration strikes, or WAF violations. Despite the clean threat posture, the presence of signal contradictions regarding geographic origin warrants monitoring. The recommended action is to monitor the address at low severity due to mixed signals, with no automatic firewall rules generated.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Amazon.com, Inc. |
| ASN | AS16509 |
| Network Name | AMAZO-ZDUB3 |
| CIDR Block | 54.216.0.0/15 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | ec2-54-217-120-218.eu-west-1.compute.amazonaws.com |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | ec2-54-217-120-218.eu-west-1.compute.amazonaws.com |
🔐 DNS Hygiene
| Hygiene Score | 60% (Good) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | Apache |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | *.samsungapps.comsamsungapps.com |
| Valid From | 2026-01-27T00:00:00+00:00 |
| Valid Until | 2027-02-27T23:59:59+00:00 |
| TLS Protocol | Tls12 |
| Cipher Suite | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
| Signature Algorithm | sha256RSA |
| Validity Period | 396 days |
| Serial Number | 064772DF706B47674722C1834FCBB1A6 |
| Thumbprint | EAD7059B63800BE769A6AE97EBE740532E38D9C9 |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 40% | 2 | 3 |
| routing | 20% | 1 | 1 |
| services | 40% | 2 | 3 |
| ownership | 40% | 2 | 3 |
| reputation | 20% | 1 | 2 |
| geolocation | 40% | 2 | 3 |
| Overall | 33% | 10 | 15 |
| Data Coherence | Mixed Signals (68%) — 2 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
⚠ TLS certificate claims KR but primary geo says IE
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-18 11:54:18 UTC |
| Last Seen | 2026-09-21 10:02:28 UTC |
| Profile Built | 2026-09-21 12:07:09 UTC |
| Data Freshness | Live |
| Signal Types | 25 |
| Total Observations | 43 |
Full dossier details are available via our API.