# 128.116.5.11 — IP Intelligence Summary

128.116.5.11 is an IPv4 address operated by Roblox (AS22697), geolocated to Frankfurt am Main, Germany. As of October 29, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/128.116.5.11
- Last updated: 2026-10-29

## Ownership

- Organization: Roblox
- Network name: RC-376
- Allocated block: 128.116.0.0/17
- ASN: AS22697 (https://ipdebrief.com/asn/22697)
- Regional registry: ARIN

## Location

- City: Frankfurt am Main
- Region: CA
- Country: Germany
- Time zone: America/Los_Angeles

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Exposed services

- 443/tcp — https

## Analyst narrative

The IP 128.116.5.11 is owned by Roblox Corporation (ASN 22697) but is assigned a critical risk score of 70 with a recommendation to block. Threat intelligence categorizes this node as campaign infrastructure correlated with 32 associated IPs and 16 certificate matches. Geolocation data presents a contradiction, listing the location as Frankfurt am Main, DE, while ownership and TLS certificate records indicate the United States. Operational analysis reveals a Pingora server banner on port 443 with a TLS certificate valid for rover.na.roblox.net until April 2027.

## Nearby addresses

- 128.116.5.3 (https://ipdebrief.com/128.116.5.3)
- 128.116.5.33 (https://ipdebrief.com/128.116.5.33)
- 128.116.5.65 (https://ipdebrief.com/128.116.5.65)
- 128.116.5.66 (https://ipdebrief.com/128.116.5.66)
- 128.116.5.67 (https://ipdebrief.com/128.116.5.67)
- 128.116.5.68 (https://ipdebrief.com/128.116.5.68)
- 128.116.5.70 (https://ipdebrief.com/128.116.5.70)
- 128.116.5.71 (https://ipdebrief.com/128.116.5.71)
- 128.116.5.72 (https://ipdebrief.com/128.116.5.72)
- 128.116.5.73 (https://ipdebrief.com/128.116.5.73)
- 128.116.5.76 (https://ipdebrief.com/128.116.5.76)
- 128.116.5.77 (https://ipdebrief.com/128.116.5.77)

## Addresses sharing infrastructure

- 128.116.2.11 — Same TLS certificate (https://ipdebrief.com/128.116.2.11)
- 128.116.13.11 — Same TLS certificate (https://ipdebrief.com/128.116.13.11)
- 128.116.14.11 — Same TLS certificate (https://ipdebrief.com/128.116.14.11)
- 128.116.21.11 — Same TLS certificate (https://ipdebrief.com/128.116.21.11)
- 128.116.30.11 — Same TLS certificate (https://ipdebrief.com/128.116.30.11)
- 128.116.31.11 — Same TLS certificate (https://ipdebrief.com/128.116.31.11)
- 128.116.32.11 — Same TLS certificate (https://ipdebrief.com/128.116.32.11)
- 128.116.44.11 — Same TLS certificate (https://ipdebrief.com/128.116.44.11)
- 128.116.45.11 — Same TLS certificate (https://ipdebrief.com/128.116.45.11)
- 128.116.47.11 — Same TLS certificate (https://ipdebrief.com/128.116.47.11)
- 128.116.48.11 — Same TLS certificate (https://ipdebrief.com/128.116.48.11)
- 128.116.50.11 — Same TLS certificate (https://ipdebrief.com/128.116.50.11)

---

Source: IPDebrief, "128.116.5.11 IP intelligence", https://ipdebrief.com/128.116.5.11, updated 2026-10-29. Assessments are probabilistic.