47.128.119.160📋 Copy

IP Intelligence Briefing: 47.128.119.160

Date: 2026-06-09

---

**1. Core Profile**

• Reputation: Moderate Risk (Risk Score: 40)
• Ownership: Amazon Data Services Singapore (ASN: 16509)
• Geolocation: Singapore (1.35°N, 103.82°E), Asia/Singapore timezone
• Network Role: AWS EC2 instance (Firewalled / No Services)
• Threat Indicators: No malicious activity detected (zero indicators, no blacklists, no campaigns).

---

**2. Network Context**

• Subnet: 47.128.119.160/24
• Abuse Density: 55.84% (High Abuse classification)
• Neighboring IPs:

- 69 IPs flagged as medium-risk (avg. score: 40)

- 15 IPs flagged as low-risk

- 43 IPs in subnet linked to threats (potential lateral movement risk)

• Subnet Owner: AMAZON-SIN (AWS Singapore region)

---

**3. Observations & Behavior**

• Historical Signals:

- 22 observations over 30 days (last updated 2026-06-09).

- Mixed confidence levels (0.21–0.95), with 17% of signals indicating "high_abuse" classification.

- No persistent malicious activity (threat persistence: 0 days).

• DNS Associations:

- Linked to AWS EC2 hostname: `ec2-47-128-119-160.ap-southeast-1.compute.amazonaws.com`

- Valid DNSSEC, SPF, and DMARC records.

---

**4. Threat & Security Implications**

• No Direct Threat: The IP itself shows no malicious indicators (zero blacklists, no campaigns, no spam).
• Subnet Risk: High abuse density in the 47.128.119.160/24 subnet suggests potential for lateral movement or shared infrastructure risks.
• Actionable Steps:

- Monitor subnet for unusual activity (e.g., unexpected DNS changes, port scanning).

- Consider blocking the entire 47.128.119.160/24 subnet if isolating AWS resources.

- Validate DNS records and ensure AWS security groups are properly configured.

---

**5. Summary**

The IP is a legitimate AWS EC2 instance with no direct malicious activity. However, its subnet exhibits high abuse density, warranting closer scrutiny. SOC teams should focus on monitoring the subnet for anomalous behavior and ensure proper segmentation of cloud resources.

Recommended Tools: Use AWS WAF to block the subnet, and correlate with neighbor IPs for deeper analysis.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.