Hmmm... but if I had know it was hosted on AWS at the beginning, the security group would have been the first thing I checked rather than curl or tcp dump, espe

Hmmm... but if I had know it was hosted on AWS at the beginning, the security group would have been the first thing I checked rather than curl or tcp dump, especially given the odd port. The syn packet isn’t exactly diagnostic... as is mentioned other things can drop syn packets. For instance if your host file was redirecting to a random IP which was firewalled... same issue. Context is everything, and knowing your system and stacks rather than single tools is important. What this shows me is that partitioning of knowledge where only certain team members understand certain things is the real danger.