# 128.116.14.11 — IP Intelligence Summary

128.116.14.11 is an IPv4 address operated by Roblox (AS22697), geolocated to Hong Kong, Hong Kong. As of November 4, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/128.116.14.11
- Last updated: 2026-11-04

## Ownership

- Organization: Roblox
- Network name: RC-376
- Allocated block: 128.116.0.0/17
- ASN: AS22697 (https://ipdebrief.com/asn/22697)
- Regional registry: ARIN

## Location

- City: Hong Kong
- Region: —
- Country: Hong Kong
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 443/tcp — https

## Analyst narrative

**INTELLIGENCE BRIEFING: 128.116.14.11/32**

**Classification:** Moderate Risk

**Risk Score:** 40

**Status:** Live

**Summary:**

The address 128.116.14.11 was identified as a web server owned by Roblox Corporation (ASN 22697). The asset is located within the 128.116.0.0/17 block and primarily serves the \`rover.na.roblox.net\` domain. While the ownership is verified, the asset carries a moderate risk profile with conflicting geolocation data.

**Technical Observations:**

*   **Service:** HTTPS (TCP Port 443)

*   **Server:** Pingora

*   **TLS:** Certificate subject \`rover.na.roblox.net\` issued by Sectigo Public Server Authentication CA OV R36.

*   **Geolocation:** Reported as Hong Kong, HK. Geo validation flagged a contradiction between the 9173.5 km distance claim and the observed 55.2 ms RTT.

*   **Connectivity:** BGP prefix 128.116.14.0/24 showed unstable routing. The asset was listed on one of eight queried DNS blocklists.

**Threat Assessment:**

*   **Indicator Status:** No specific active threat indicators were detected. The asset was not classified as a known attacker, spam source, or Tor exit node.

*   **Campaign:** Medium likelihood of campaign involvement; 8 correlated IPs were identified.

*   **Neighborhood:** The subnet 128.116.14.0/24 exhibited an abuse density of 0.6667 with two active threat siblings.

*   **Hygiene:** DNS hygiene was rated Poor due to missing DMARC and DNSSEC records.

**Recommendation:**

Due to the moderate risk score and neighborhood abuse density, the asset should be rate-limited to prevent potential abuse while maintaining connectivity.

**Mitigation Rules:**

*   **iptables:** \`iptables -A INPUT -s 128.116.14.11 -m limit --limit 5/min -j ACCEPT\`

*   **nginx:** \`limit_req zone=ipdebrief burst=5;\`

*   **pf:** \`pass in on egress from 128.116.14.11 max-pkt-rate 5/1\`

## Nearby addresses

- 128.116.14.3 (https://ipdebrief.com/128.116.14.3)
- 128.116.14.33 (https://ipdebrief.com/128.116.14.33)

## Addresses sharing infrastructure

- 128.116.2.11 — Same TLS certificate (https://ipdebrief.com/128.116.2.11)
- 128.116.5.11 — Same TLS certificate (https://ipdebrief.com/128.116.5.11)
- 128.116.13.11 — Same TLS certificate (https://ipdebrief.com/128.116.13.11)
- 128.116.21.11 — Same TLS certificate (https://ipdebrief.com/128.116.21.11)
- 128.116.30.11 — Same TLS certificate (https://ipdebrief.com/128.116.30.11)
- 128.116.31.11 — Same TLS certificate (https://ipdebrief.com/128.116.31.11)
- 128.116.32.11 — Same TLS certificate (https://ipdebrief.com/128.116.32.11)
- 128.116.44.11 — Same TLS certificate (https://ipdebrief.com/128.116.44.11)
- 128.116.45.11 — Same TLS certificate (https://ipdebrief.com/128.116.45.11)
- 128.116.47.11 — Same TLS certificate (https://ipdebrief.com/128.116.47.11)
- 128.116.48.11 — Same TLS certificate (https://ipdebrief.com/128.116.48.11)
- 128.116.50.11 — Same TLS certificate (https://ipdebrief.com/128.116.50.11)

---

Source: IPDebrief, "128.116.14.11 IP intelligence", https://ipdebrief.com/128.116.14.11, updated 2026-11-04. Assessments are probabilistic.