Check-Host.cc

IP Address IPv4

52.78.124.240

Aggregated from public BGP, CT logs, our scan layer, honeypots and global probes.

Run a live full scan of 52.78.124.240

On-demand: ports, banners, TLS, tech-stack, subdomains and origin/IP-leak detection. Results are shared publicly for everyone to link to.

Deep-scan now
ASN
AS16509
Amazon.com
Country
KR
South Korea
Reverse DNS
ec2-52-78-124-240.ap-northeast-2.compute.amazonaws.com
PTR
Open Ports
3
Last scan

Autonomous System

ASN
AS Name
Amazon.com
AS Type
RIR
ARIN
Allocated
2000-05-04
Allocation status
Allocated

Geolocation

Country
KR · South Korea
Continent
Asia
Source
MaxMind GeoLite2

Reverse DNS

Last seen
2026-06-23 12:35:12

Network

Prefix
RPKI

Open Ports

Port Proto Service Server Last seen
22 tcp ssh 2026-06-23 12:34:45.000
80 tcp http Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/5.6.39 2026-05-27 03:55:39.000
443 tcp https Apache/2.4.34 (Amazon) OpenSSL/1.0.2k-fips PHP/5.6.39 2026-06-20 15:14:45.000

TLS Certificates

Port 443 af68794a5623…
Subject: ip-172-31-3-161
Issuer: ip-172-31-3-161
SANs: ip-172-31-3-161, ip-172-31-3-161.ap-northeast-2.compute.internal, localhost, localhost.localdomain
Valid 2017-09-27 05:28:44 → 2018-09-27 05:28:44
Port 443 af68794a5623…
Subject: ip-172-31-3-161
Issuer: ip-172-31-3-161
SANs: ip-172-31-3-161, ip-172-31-3-161.ap-northeast-2.compute.internal, localhost, localhost.localdomain
Valid 2017-09-27 05:28:44 → 2018-09-27 05:28:44

Known Vulnerabilities

Published CVEs matched to the software versions fingerprinted on this host. Matching is by product and version against the NVD dictionary — presence of a CVE does not confirm the host is exploitable (patches or backports may apply).

CVE Software CVSS Severity Summary
CVE-2019-10097 Apache 2.4.34 7.2 N/A In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted...
CVE-2018-17189 Apache 2.4.34 5.3 N/A In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily...

Tech Stack

Wappalyzer fingerprinting pending

HTTP-body analysis identifies web frameworks, CMS platforms, analytics, JS libraries and server-side languages from this host.

Origin / IP-Leak

USP

When a hostname is served behind a CDN (e.g. Cloudflare), the origin server can sometimes be identified by matching its TLS cert against the protected hostname. Findings shown here are heuristic candidates, not guarantees.

No origin-leak candidates for this IP

When this IP serves a TLS cert for a domain that fronts behind a CDN, that domain surfaces here as an origin-leak candidate with a confidence score.

Hosted Domains

1 domain resolve (A-record) to this IP.

Multi-Vantage Check

Reachability accrued passively from real user-triggered checks across our 65+ probe nodes. Run a live check to add fresh data.

No accumulated reachability data yet

Reachability accrues from real user-triggered checks. Trigger a Ping or HTTP check from our 65+ probe nodes to contribute the first data point.

Web Pages

Port Page title Status Flags
443 Test Page for the Apache HTTP Server on the Amazon Linux AMI 403
80 TheDayBefore, Inc 200

Threat Intelligence

No threat-intel matches

This IP doesn't appear in any of the feeds we mirror (Tor exits, FireHOL Level 1-3, Spamhaus DROP/EDROP, URLhaus, OpenPhish). Absence here doesn't prove the IP is clean — it just means none of our public-feed sources flag it.

Co-Hosted Domains

No DNS-confirmed domains yet

We cross-reference body-cited domains against our DNS resolver records. Confirmations appear here once both sides have data for the same name.

External References

No external references found yet

As HTML bodies get banner-grabbed, references to external domains land here.

History

First observed
2026-05-26 02:27
Last observed
2026-06-23 12:34
Scan observations
12

The full change-log (ASN moves, cert rotations, port-state diffs) accumulates as our archives grow.