47.128.119.146📋 Copy

# INTELLIGENCE BRIEFING: IP Address 47.128.119.146/32

Date: 2026-06-16

Classification: Moderate Risk - Cloud Infrastructure

Primary Location: Singapore, Asia-Pacific (ap-southeast-1)

---

## Executive Summary

IP address 47.128.119.146 is identified as an Amazon Web Services (AWS) EC2 instance deployed in Singapore. The host exhibits a moderate risk profile (score: 40/100) with no active threat indicators. However, the host resides within a /24 subnet classified as HIGH ABUSE (abuse density: 0.7079), with 63 of 89 sibling IPs flagged as threat sources. This contextual risk requires monitoring despite the individual host's benign characteristics.

---

## Technical Profile

Ownership & Registration:

• ASN: 16509 (Amazon Data Services Singapore)
• Organization: AMAZON-SIN
• CIDR Block: 47.128.0.0/14
• Infrastructure Type: CloudCompute (AWS)

Geolocation:

• Country: Singapore (SG)
• City: Singapore
• Coordinates: 1.35°N, 103.82°E
• Geo Consensus: True (1 source)

DNS Resolution:

• PTR Hostname: ec2-47-128-119-146.ap-southeast-1.compute.amazonaws.com
• Forward Resolution: Confirmed (amazonaws.com)
• Email Authentication: SPF and DMARC records present

---

## Threat Intelligence Assessment

Direct Threat Indicators:

• Threat Indicators: None detected
• Abuse Confidence Score: Not applicable
• Known Attacker Status: False
• Spam Source: False
• Tor Exit Node: False
• Blacklist Count: 0
• Known Campaigns: None

Network Classification:

• Provider: Amazon Web Services
• Connection Type: Cloud
• Hosting: Yes
• Proxy/Vpn: No
• Mobile/Residential: No

Service Status:

• Open Ports: None detected (firewalled/no services exposed)
• TLS Certificate: None
• HTTP Services: None

---

## Neighborhood Analysis

Subnet Context (47.128.119.0/24):

• Total Siblings: 89 IPs
• Active Siblings: 66
• Threat Siblings: 63 (71% of active IPs)
• Abuse Density: 0.7079 (HIGH)
• Inherited Risk Score: 28/100

Risk Distribution:

• High Risk: 0 IPs
• Medium Risk: 88 IPs
• Low Risk: 6 IPs

Neighboring IP Risk Scores: Multiple neighbors (47.128.119.2, 47.128.119.12-15) show risk scores of 40/100 with authority scores of 60, indicating consistent abuse patterns across the subnet.

---

## Historical Observation Timeline

Total Observations: 21 signals over monitoring period

Recent Signal Summary (June 2026):

1. 06-16 00:53: Subnet abuse classification confirmed (high_abuse, abuse density 0.7079)

2. 06-16 00:46: Operator score assessment (0.2609, label: Basic)

3. 06-11 04:06: Cloud infrastructure classification (AWS confirmed)

4. 06-11 04:06: Geolocation inference (Singapore, confidence 0.56)

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: False
• Route Stability: Unstable (not route-stable)

---

## Relationship Graph

Primary Associations:

• DNS Associations: ec2-47-128-119-146.ap-southeast-1.compute.amazonaws.com (multiple entries)
• Network Associations: AMAZON-SIN (multiple entries)
• External Entities: None detected beyond AWS infrastructure

---

## Recommended Actions

For SOC Analysts:

1. Monitor Contextually: While this specific IP shows no direct threat indicators, monitor for lateral movement from the high-abuse /24 subnet

2. Allow Traffic: No immediate block required; traffic appears to be legitimate AWS infrastructure

3. Watchlist Addition: Consider adding to contextual watchlist due to subnet-level abuse density

4. Baseline Establishment: Record current service state (firewalled) for anomaly detection

Firewall/Access Control:

• No immediate blocking recommended
• Monitor for port scan activity from this subnet
• Apply standard cloud infrastructure allow-listing policies

---

## Intelligence Confidence

Data Quality: Moderate

• Geo Confidence: 0.56
• Operator Score: 0.2609 (Basic)
• Signal Sources: 6 total dimensions covered
• Total Observations: 21

Confidence Assessment: The IP is confirmed as AWS cloud infrastructure with no direct malicious indicators. Risk assessment is driven primarily by subnet-level abuse patterns rather than host-specific threats.

---

Report Generated: 2026-06-16

Analysis Period: June 2026

Data Source: IPDebrief Intelligence Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.