47.128.110.75📋 Copy

# IP Intelligence Briefing: 47.128.110.75

Classification: MODERATE RISK | Report Date: 2026-06-18

---

## Executive Summary

IP address 47.128.110.75 is a cloud-hosted AWS EC2 instance located in Singapore (ap-southeast-1). The IP carries a moderate risk score of 50 and is associated with high-abuse subnet 47.128.110.0/24. While the IP itself shows no active threat indicators, its neighborhood demonstrates elevated abuse density (0.6) with 12 of 20 sibling IPs flagged as threats.

---

## Ownership & Infrastructure

---

## Threat Assessment

Current Risk Score: 50 (Moderate)

Threat Indicators:

• No active threat campaigns detected
• No known attacker or spam source classification
• Not a Tor exit node or proxy
• Listed on 2 of 8 DNSBL entries with maximum severity "high"
• DNSBL total listings: 8

Historical Context:

• 21 signal observations recorded
• Subnet classified as "high_abuse" with 0.6 abuse density
• Recent DNS operator score: 0.2609 (Basic)
• No persistent malicious activity detected over observation window

---

## Neighborhood Analysis (47.128.110.0/24)

Adjacent IP Risk Distribution:

• High Risk (60+): 0
• Medium Risk (40-59): 17 IPs (e.g., 47.128.110.9, .68, .69, .70, .72, .74, .76-.88, .92, .97)
• Low Risk (0-39): 2 IPs (47.128.110.73, .95 at 25)

---

## Network Behavior

Services: None detected (Firewalled / No Services)

Open Ports: Empty

TLS Certificate: None

HTTP Banner: None

Control Plane:

• BGP Prefix: 47.128.0.0/14
• Route Stability: Unstable
• RPKI State: Not available
• DNSSEC: Valid
• IRR Consistency: Not available

---

## Recommended Actions

Based on the moderate risk profile and subnet abuse density, the following blocking rules are recommended:

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 47.128.110.75 -j DROP

# nftables

nft add rule inet filter input ip saddr 47.128.110.75 drop

# nginx

deny 47.128.110.75;

# pfSense

47.128.110.75/32

```

Cloud WAF Integration:

• Cloudflare WAF: Block with expression `ip.src eq 47.128.110.75`
• AWS WAF: Address `47.128.110.75/32`, description "IPDebrief risk 50"

---

## Intelligence Notes

1. Cloud Infrastructure Context: This IP is a standard AWS EC2 instance. Moderate risk scores are common for cloud infrastructure shared across multiple tenants.

2. Subnet Elevation Risk: The /24 subnet shows high abuse density. Consider implementing subnet-level blocking for 47.128.110.0/24 if organizational policy permits.

3. Monitoring Recommendation: Add to threat monitoring due to DNSBL listings and neighborhood activity. Correlate with other signals before taking definitive action.

4. Relationship Context: IP is associated with AMAZON-SIN network. Additional relationships to Amazon infrastructure detected.

---

Analyst Notes: No immediate threat indicators observed on the IP itself. Action recommendations are probabilistic and should be combined with other threat signals, organizational policy, and traffic analysis before implementation.

Data Source: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.