IP Report
43.201.112.3
Amazon.com, Inc. · AS16509 · Incheon, South Korea
Score 60 of 100, in the medium risk band. Bands run 0 to 19 minimal, 20 to 49 low, 50 to 79 medium, 80 to 100 high.
Its risk score of 60/100 is elevated — enough signal to justify friction such as a CAPTCHA or extra verification, though not necessarily an outright block.
Detection signals
Not detected: Tor, VPN, Proxy, Crawler
Summary
43.201.112.3 is a server address in aws's cloud, not a home or mobile connection. Traffic from it is almost always software: a scraper, a monitor, an API client, or a service someone deployed.
The address is announced by Amazon.com, Inc. (AS16509) and geolocates to Incheon, South Korea.
Why this address scores 60
It sits in datacenter address space, where automated traffic vastly outnumbers human visitors.
Together these produce the score of 60/100 shown above.
Observation history
This address has been looked up through Predax 8 times, first on September 3, 2026.
Each lookup re-evaluates the address against current feeds, so the classification above reflects its most recent check, not a stale record.
Network & location
- ASN
- AS16509
- Country
- South Korea (KR)
- Provider
- Amazon.com, Inc.
- Region
- Incheon
- CIDR
- 43.198.0.0/11
- City
- Incheon
- Network type
- hosting
- PTR
- ec2-43-201-112-3.ap-northeast-2.compute.amazonaws.com
- Cloud provider
- aws
- Cloud service
- EC2
- Cloud region
- ap-northeast-2
- Cloud CIDR
- 43.200.0.0/14
- First seen
- 9/3/2026, 9:08:03 PM
- Last seen
- 9/3/2026, 11:11:46 PM
- Times seen
- 8
Network context
We have observed 3,045 addresses on Amazon.com, Inc. (AS16509); 94% of them carried a threat flag or a notable risk score when last checked.
That is a high concentration — on this network, an unfamiliar address deserves more caution than its individual score alone would suggest.
What to do with this
If you run a site and this address showed up
Traffic from server space is rarely a person on a browser. If this address hit your site, it was most likely a bot, a monitor, or a scripted client.
Unblocking it is only worth doing if you can tie it to a service you actually use — an uptime monitor, a payment webhook, an integration. Otherwise a block costs you nothing.
For a store, an address scoring 60/100 matters most at checkout — the WooCommerce fraud plugin screens every order against this data before the payment provider is contacted, so a blocked attempt never becomes a chargeback.
If you found this address in your logs
In your logs this address is almost certainly automation. Check the user agent and the request pattern before attributing its traffic to a human.
If you operate this address yourself and it is being blocked elsewhere, this datacenter classification is why — hosting IPs start from a lower trust position everywhere.
Loading map...
Detection sources
- DatacenterVerified · 95%
Listed in a published datacenter range feed. Hosted in a cloud / datacenter range. Typical of automation, scrapers, and bots — not consumer browsers.