# 128.116.2.11 — IP Intelligence Summary

128.116.2.11 is an IPv4 address operated by Roblox (AS22697), geolocated to United States. As of November 1, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/128.116.2.11
- Last updated: 2026-11-01

## Ownership

- Organization: Roblox
- Network name: RC-376
- Allocated block: 128.116.0.0/17
- ASN: AS22697 (https://ipdebrief.com/asn/22697)
- Regional registry: ARIN

## Location

- City: —
- Region: —
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 443/tcp — https

## Analyst narrative

**Intelligence Briefing: 128.116.2.11/32**

**Target Overview**

The IP address 128.116.2.11 is registered to Roblox Corporation under ASN 22697 (RC-376, 128.116.0.0/17). The address operates as a Web Server on port 443 (HTTPS) utilizing a Pingora server banner. TLS certificates indicate the subject domain rover.na.roblox.net.

**Threat Assessment**

The address carries a High Risk reputation score of 70. Intelligence classification identifies this resource as Campaign Infrastructure with a high likelihood of campaign association. Observations revealed 23 certificate matches and 46 correlated IPs within the threat network. The neighborhood context shows a mixed classification with an abuse density of 0.33 and 2 identified threat siblings.

**Anomalies and Indicators**

Geolocation validation failed, showing a claimed US origin with a 7625km distance versus a 46ms RTT. DNS hygiene was rated Poor (Score 20) due to the absence of DMARC and other security records. The control plane indicated route instability and a single DNS blacklisting entry.

**Recommendation**

The address requires immediate blocking at the firewall. Severity is critical due to the high risk score and strong threat evidence despite ownership attribution. Firewall rules should be implemented to drop traffic from this source.

## Nearby addresses

- 128.116.2.3 (https://ipdebrief.com/128.116.2.3)
- 128.116.2.33 (https://ipdebrief.com/128.116.2.33)
- 128.116.2.65 (https://ipdebrief.com/128.116.2.65)
- 128.116.2.66 (https://ipdebrief.com/128.116.2.66)
- 128.116.2.67 (https://ipdebrief.com/128.116.2.67)

## Addresses sharing infrastructure

- 128.116.5.11 — Same TLS certificate (https://ipdebrief.com/128.116.5.11)
- 128.116.13.11 — Same TLS certificate (https://ipdebrief.com/128.116.13.11)
- 128.116.14.11 — Same TLS certificate (https://ipdebrief.com/128.116.14.11)
- 128.116.21.11 — Same TLS certificate (https://ipdebrief.com/128.116.21.11)
- 128.116.30.11 — Same TLS certificate (https://ipdebrief.com/128.116.30.11)
- 128.116.31.11 — Same TLS certificate (https://ipdebrief.com/128.116.31.11)
- 128.116.32.11 — Same TLS certificate (https://ipdebrief.com/128.116.32.11)
- 128.116.44.11 — Same TLS certificate (https://ipdebrief.com/128.116.44.11)
- 128.116.45.11 — Same TLS certificate (https://ipdebrief.com/128.116.45.11)
- 128.116.47.11 — Same TLS certificate (https://ipdebrief.com/128.116.47.11)
- 128.116.48.11 — Same TLS certificate (https://ipdebrief.com/128.116.48.11)
- 128.116.50.11 — Same TLS certificate (https://ipdebrief.com/128.116.50.11)

---

Source: IPDebrief, "128.116.2.11 IP intelligence", https://ipdebrief.com/128.116.2.11, updated 2026-11-01. Assessments are probabilistic.