47.128.112.238📋 Copy

IP Intelligence Briefing: 47.128.112.238

Date: 2026-06-11

---

**1. Core Profile**

• Reputation: Moderate Risk (Risk Score: 40)
• Provider: Amazon Web Services (AWS)
• Ownership: Owned by Amazon Data Services Singapore (ASN: 16509, Netname: AMAZON-SIN)
• Geolocation:

- Country: United States (US)

- Region: Illinois (US-IL)

- City: Chicago

- Timezone: America/Chicago

• Network Role:

- Type: Cloud Compute (AWS infrastructure)

- Classification: Firewalled / No Services

- Subnet: 47.128.112.238/24 (High Abuse Density: 69%)

---

**2. Threat Indicators**

• Malicious Activity: No detected indicators (no blacklists, spam, or campaigns).
• DNS Associations:

- Linked to AWS EC2 hostname: `ec2-47-128-112-238.ap-southeast-1.compute.amazonaws.com`.

• Subnet Risk:

- Abuse Density: 69% (high risk).

- Threat Siblings: 69 IPs in the subnet show malicious activity.

---

**3. Historical Observations**

• Geolocation Discrepancy:

- Conflicting data shows the IP resolving to Singapore (latitude: 1.2872, longitude: 103.8507) despite AWS ownership.

• Stability:

- Subnet route stability: Unstable (route changes detected).

- No persistent malicious activity over 30 days.

---

**4. Relationships**

• Network:

- Same network as AMAZON-SIN (AWS).

• DNS:

- Direct association with AWS EC2 instances.

---

**5. Neighborhood Analysis**

• Subnet: 47.128.112.238/24
• Sibling IPs:

- 100 total IPs in subnet; 59 active, 69 flagged as malicious.

- Risk Distribution: 88 medium-risk IPs, 11 low-risk IPs.

---

**6. Recommended Actions**

• Monitoring:

- Investigate geolocation discrepancies (potential misattribution or spoofing).

- Monitor subnet for anomalous traffic due to high abuse density.

• Firewall Rules:

- iptables: `iptables -A INPUT -s 47.128.112.238 -j DROP`

- Cloudflare WAF: Block IP with rule: `ip.src eq 47.128.112.238`

- AWS WAF: Add rule: `47.128.112.238/32`

---

Conclusion:

The IP is part of AWS infrastructure and appears legitimate. However, its subnet (47.128.112.238/24) has a high abuse density, suggesting potential risks. While the IP itself shows no direct malicious activity, the network environment warrants further investigation. SOC teams should prioritize monitoring this subnet for suspicious behavior and validate geolocation inconsistencies.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.