47.128.112.21📋 Copy

## INTELLIGENCE BRIEFING: 47.128.112.21/32

Classification: Moderate Risk – Cloud Infrastructure

Date: 2026-06-14

Analyst: IPDebrief Intelligence

---

EXECUTIVE SUMMARY

IP address 47.128.112.21 is a legitimate Amazon Web Services (AWS) EC2 instance hosted in the Singapore region (ap-southeast-1). The IP carries a moderate risk score of 40/100 with no direct threat indicators. However, the associated /24 subnet exhibits high abuse density (0.75), suggesting elevated activity from neighboring addresses.

---

NETWORK OWNERSHIP & GEOLOCATION

---

THREAT ASSESSMENT

Risk Profile: Moderate Risk (40/100)

Operator Score: 0.2609 (Basic)

Threat Indicators: None detected

Known Campaigns: None

Campaign Likelihood: None

Direct Threat Signals:

• Blacklist Status: 1 of 8 DNSBL lists (12.5% listing rate)
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False
• Abuse Confidence Score: Not available

Network Role:

• Cloud Infrastructure: Yes
• CDN: No
• VPN/Proxy: No
• Tor Network: No
• Bogon: No
• Mobile/Residential: No

---

DNS & HOSTNAME INTELLIGENCE

PTR Hostname: `ec2-47-128-112-21.ap-southeast-1.compute.amazonaws.com`

Forward Resolution: Confirmed (1 hostname)

Domain: amazonaws.com

Email Authentication: SPF and DMARC records present

Service Banner: No open ports detected (Firewalled / No Services)

---

SUBNET ANALYSIS (47.128.112.0/24)

Classification: high_abuse

Abuse Density: 0.75 (High)

Total Sibling IPs: 100

Active Siblings: 72

Threat Siblings: 75

Risk Distribution:

• High Risk: 0 IPs
• Medium Risk: 97 IPs
• Low Risk: 2 IPs

Inherited Risk: 30/100

Analysis: The /24 subnet is heavily utilized with AWS infrastructure. While the target IP shows moderate risk, the high abuse density indicates this subnet block has been associated with significant malicious activity. This warrants heightened monitoring of traffic patterns from this IP block.

---

OBSERVATION HISTORY

Total Observations: 19 signals collected

Latest Signals: 2026-06-14 (same day)

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: False
• Threat Observation Count: 1

The IP demonstrates stable ownership with no evidence of malicious persistence. Recent signals confirm consistent geolocation and network classification.

---

RELATIONSHIP GRAPH

Total Relationships: 39

Key Associations:

• Network: AMAZON-SIN (multiple entries)
• DNS: ec2-47-128-112-21.ap-southeast-1.compute.amazonaws.com

All relationships confirm AWS infrastructure ownership with no external or suspicious associations detected.

---

RECOMMENDED ACTIONS

Current Risk Level: Moderate – No immediate threat-based actions required

Recommended Firewall Rules (if blocking desired):

```bash

# iptables

iptables -A INPUT -s 47.128.112.21 -j DROP

# nftables

nft add rule inet filter input ip saddr 47.128.112.21 drop

# pfSense

47.128.112.21/32

# Cloudflare WAF

{"description":"Block 47.128.112.21 — IPDebrief risk score 40","action":"block","filter":{"expression":"ip.src eq 47.128.112.21"}}

# AWS WAF

{"Addresses":["47.128.112.21/32"],"Description":"IPDebrief risk 40"}

```

SOC Analyst Notes:

• No direct threat indicators detected on this IP
• Subnet-level abuse density warrants monitoring of related addresses
• Standard AWS cloud instance with no open services
• Recommended to monitor for anomalous behavior patterns rather than immediate blocking
• Consider blocking at subnet level (47.128.112.0/24) if threat activity is observed from sibling IPs

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.