# 128.116.13.11 — IP Intelligence Summary

128.116.13.11 is an IPv4 address operated by Roblox (AS22697), geolocated to Newark, United States. As of November 2, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/128.116.13.11
- Last updated: 2026-11-02

## Ownership

- Organization: Roblox
- Network name: RC-376
- Allocated block: 128.116.0.0/17
- ASN: AS22697 (https://ipdebrief.com/asn/22697)
- Regional registry: ARIN

## Location

- City: Newark
- Region: US-NJ
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 443/tcp — https

## Analyst narrative

**Intelligence Briefing: 128.116.13.11/32**

**Classification:** High Risk (Risk Score: 70)

**Ownership:** Roblox Corporation (AS22697), CIDR: 128.116.0.0/17

**Location:** Newark, New Jersey, US

**Network Activity:**

The IP address was identified as an HTTPS web server operating on port 443 with a Pingora server banner. Geolocation validation placed the host in the United States with a minimum possible RTT of 99ms. Activity was observed between October 17 and October 25, 2026.

**Threat Assessment:**

Despite the absence of specific threat indicators and a blacklist count of zero, the risk assessment classified the address as High Risk. The recommendation was to Block the address with critical severity due to the high risk score and strong threat evidence. The surrounding subnet was classified as mostly clean with an abuse density of 0.1667.

**Technical Hygiene:**

DNS hygiene was rated as Poor (Score: 20). SPF records were present, but DMARC, DNSSEC, and CAA records were missing. Intent classification was marked as Unknown, and overall data confidence was rated as Very Low (0.125).

**Action:**

Block the IP address at the firewall perimeter (iptables, nginx, or pf).

## Nearby addresses

- 128.116.13.3 (https://ipdebrief.com/128.116.13.3)
- 128.116.13.34 (https://ipdebrief.com/128.116.13.34)
- 128.116.13.65 (https://ipdebrief.com/128.116.13.65)
- 128.116.13.66 (https://ipdebrief.com/128.116.13.66)
- 128.116.13.67 (https://ipdebrief.com/128.116.13.67)

## Addresses sharing infrastructure

- 128.116.2.11 — Same TLS certificate (https://ipdebrief.com/128.116.2.11)
- 128.116.5.11 — Same TLS certificate (https://ipdebrief.com/128.116.5.11)
- 128.116.14.11 — Same TLS certificate (https://ipdebrief.com/128.116.14.11)
- 128.116.21.11 — Same TLS certificate (https://ipdebrief.com/128.116.21.11)
- 128.116.30.11 — Same TLS certificate (https://ipdebrief.com/128.116.30.11)
- 128.116.31.11 — Same TLS certificate (https://ipdebrief.com/128.116.31.11)
- 128.116.32.11 — Same TLS certificate (https://ipdebrief.com/128.116.32.11)
- 128.116.44.11 — Same TLS certificate (https://ipdebrief.com/128.116.44.11)
- 128.116.45.11 — Same TLS certificate (https://ipdebrief.com/128.116.45.11)
- 128.116.47.11 — Same TLS certificate (https://ipdebrief.com/128.116.47.11)
- 128.116.48.11 — Same TLS certificate (https://ipdebrief.com/128.116.48.11)
- 128.116.50.11 — Same TLS certificate (https://ipdebrief.com/128.116.50.11)

---

Source: IPDebrief, "128.116.13.11 IP intelligence", https://ipdebrief.com/128.116.13.11, updated 2026-11-02. Assessments are probabilistic.