# 100.28.13.111 — IP Intelligence Summary

100.28.13.111 is an IPv4 address operated by Amazon Data Services Northern Virginia (AS14618), geolocated to Ashburn, United States. Its reverse DNS name is ec2-100-28-13-111.compute-1.amazonaws.com. As of November 4, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/100.28.13.111
- Last updated: 2026-11-04

## Ownership

- Organization: Amazon Data Services Northern Virginia
- Network name: AMAZON-IAD
- Allocated block: 100.24.0.0/13
- ASN: AS14618 (https://ipdebrief.com/asn/14618)
- Regional registry: ARIN
- Cloud / hosting provider: Amazon Web Services

## Location

- City: Ashburn
- Region: VA
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: Unknown
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ec2-100-28-13-111.compute-1.amazonaws.com
- Forward-confirmed: yes

## Exposed services

- 443/tcp — https

## Analyst narrative

Intelligence Briefing: IP 100.28.13.111/32

The address was identified as a Web Server within Amazon Web Services infrastructure located in Ashburn, Virginia. Ownership was confirmed under AS14618, Amazon Data Services Northern Virginia, within the CIDR block 100.24.0.0/13. Reverse DNS resolution returned \`ec2-100-28-13-111.compute-1.amazonaws.com\`, with forward resolution confirming \`amazonaws.com\`.

Threat assessment classified the IP as Low Risk with a risk score of 25. The address resided in a clean neighborhood with zero abuse density and no associated blacklists. Behavioral analysis revealed no honeypot hits, enumeration strikes, or WAF violations. No malicious indicators, known campaigns, or threat indicators were associated with the address.

The active service on port 443 operated as HTTPS with TLS certification issued for \`*.classlink.com\`. The server fingerprint identified as \`awselb/2.0\`. Attribution was recorded at moderate confidence with confirmed ownership.

Recommendation was to Monitor. Severity was rated low due to the clean neighborhood classification. No specific firewall rules were recommended.

## Nearby addresses

- 100.28.13.17 (https://ipdebrief.com/100.28.13.17)

## Addresses sharing infrastructure

- 3.95.75.142 — Same TLS certificate (https://ipdebrief.com/3.95.75.142)
- 3.211.22.56 — Same TLS certificate (https://ipdebrief.com/3.211.22.56)
- 3.229.156.235 — Same TLS certificate (https://ipdebrief.com/3.229.156.235)
- 18.213.224.200 — Same TLS certificate (https://ipdebrief.com/18.213.224.200)
- 32.193.92.29 — Same TLS certificate (https://ipdebrief.com/32.193.92.29)
- 32.195.174.21 — Same TLS certificate (https://ipdebrief.com/32.195.174.21)
- 32.198.178.140 — Same TLS certificate (https://ipdebrief.com/32.198.178.140)
- 32.200.130.242 — Same TLS certificate (https://ipdebrief.com/32.200.130.242)
- 34.227.237.0 — Same TLS certificate (https://ipdebrief.com/34.227.237.0)
- 34.228.51.61 — Same TLS certificate (https://ipdebrief.com/34.228.51.61)
- 34.233.245.76 — Same TLS certificate (https://ipdebrief.com/34.233.245.76)
- 34.234.44.230 — Same TLS certificate (https://ipdebrief.com/34.234.44.230)

---

Source: IPDebrief, "100.28.13.111 IP intelligence", https://ipdebrief.com/100.28.13.111, updated 2026-11-04. Assessments are probabilistic.