47.128.120.17📋 Copy

# IP Intelligence Briefing: 47.128.120.17/32

## Executive Summary

IP address 47.128.120.17 is a legitimate Amazon Web Services cloud compute instance deployed in Singapore. The IP presents low risk (risk score 25) with no active threat indicators. However, the /24 subnet exhibits moderate abuse density (42.86%) with 6 threat-identified sibling IPs, warranting contextual awareness.

## Infrastructure Profile

• Organization: Amazon Data Services Singapore (ASN 16509)
• Geolocation: Singapore (ap-southeast-1 region), coordinates 1.35°N, 103.82°E
• Network Role: Cloud Compute infrastructure
• Classification: Cloud hosting provider
• Status: Firewalled / No services exposed

## Technical Observations

DNS Resolution:

• PTR hostname: ec2-47-128-120-17.ap-southeast-1.compute.amazonaws.com
• Forward resolution confirmed to amazonaws.com domain
• SPF and DMARC records present on associated domain
• Single forward-hostname association

Control Plane:

• Origin ASN: 16509 (Amazon)
• BGP prefix: 47.128.0.0/14
• DNSBL listings: 1 of 8 total lists (minor listing)
• Operator score: 0.2609 (Basic classification)
• RPKI state: Not verified

Services Exposure:

• No open ports detected
• No TLS certificates
• No HTTP services
• No banner information captured

## Threat Assessment

Current Risk Level: Low (Score: 25)

• No known attack campaigns
• Not identified as Tor exit node, attacker, or spam source
• Zero active threat indicators in current profile
• Blacklist count: 0
• Threat observation count: 1

Historical Signals:

• 26 total observations recorded
• Recent activity from June 2026
• Consistent operator score (0.2609) across observations
• Subnet classification: Mixed
• No persistent malicious behavior detected

## Neighborhood Analysis

Subnet: 47.128.120.17/24

• Total siblings: 14
• Active siblings: 13
• Abuse density: 42.86%
• Threat siblings: 6
• All neighboring IPs show identical risk profile (risk score 25, authority score 60)

Neighbor IP Distribution:

• 47.128.120.154, 162, 172, 173, 189, 197, 203, 204, 205, 206, 214, 222, 240
• Uniform risk scoring across subnet indicates coordinated cloud deployment rather than malicious activity

## Network Relationships

• Associated with AMAZON-SIN network
• 53 relationship entities identified
• Primary DNS association with AWS compute infrastructure

## SOC Recommendations

Immediate Actions:

• No blocking required; IP shows legitimate cloud provider profile
• Monitor for service exposure if firewall configuration changes
• Standard AWS traffic logging sufficient for baseline

Contextual Awareness:

• The /24 subnet demonstrates elevated abuse density (42.86%)
• Six sibling IPs flagged as threats—monitor traffic patterns from this subnet
• Abuse density may indicate compromised EC2 instances sharing the same subnet

Detection Considerations:

• Legitimate traffic patterns expected for AWS infrastructure
• Alert on unusual port scanning or service enumeration against this IP
• Correlate with known AWS outbound patterns if investigating lateral movement

No firewall rules recommended based on current risk profile. Standard AWS egress rules apply.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.