# 13.128.249.238 — IP Intelligence Summary

13.128.249.238 is an IPv4 address operated by Amazon.com, Inc. (AS16509), geolocated to Ashburn, United States. Its reverse DNS name is ec2-13-128-249-238.compute-1.amazonaws.com. As of November 2, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/13.128.249.238
- Last updated: 2026-11-02

## Ownership

- Organization: Amazon.com, Inc.
- Network name: AMAZO-4
- Allocated block: 13.128.0.0/16
- ASN: AS16509 (https://ipdebrief.com/asn/16509)
- Regional registry: ARIN
- Cloud / hosting provider: Amazon Web Services

## Location

- City: Ashburn
- Region: VA
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: Unknown
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ec2-13-128-249-238.compute-1.amazonaws.com
- Forward-confirmed: yes

## Exposed services

- 443/tcp — https

## Analyst narrative

IP 13.128.249.238 is an Amazon Web Services EC2 instance located in Ashburn, VA, with PTR records pointing to amazonaws.com and TLS certificates for roblox.com. Despite legitimate ownership, the asset is flagged as Campaign Infrastructure with a critical severity risk score of 70 and a recommendation to block. The IP is listed on eight DNSBL lists categorized as bots and correlates with 18 certificate matches for coordinated attack infrastructure. Overall confidence remains low at 0.325, though threat evidence supports the critical block recommendation.

## Nearby addresses

- 13.128.249.22 (https://ipdebrief.com/13.128.249.22)
- 13.128.249.25 (https://ipdebrief.com/13.128.249.25)
- 13.128.249.39 (https://ipdebrief.com/13.128.249.39)
- 13.128.249.42 (https://ipdebrief.com/13.128.249.42)
- 13.128.249.86 (https://ipdebrief.com/13.128.249.86)
- 13.128.249.91 (https://ipdebrief.com/13.128.249.91)
- 13.128.249.95 (https://ipdebrief.com/13.128.249.95)
- 13.128.249.108 (https://ipdebrief.com/13.128.249.108)
- 13.128.249.109 (https://ipdebrief.com/13.128.249.109)
- 13.128.249.119 (https://ipdebrief.com/13.128.249.119)
- 13.128.249.164 (https://ipdebrief.com/13.128.249.164)
- 13.128.249.167 (https://ipdebrief.com/13.128.249.167)

## Addresses sharing infrastructure

- 13.128.248.207 — Same TLS certificate (https://ipdebrief.com/13.128.248.207)
- 13.128.248.217 — Same TLS certificate (https://ipdebrief.com/13.128.248.217)
- 13.128.249.180 — Same TLS certificate (https://ipdebrief.com/13.128.249.180)
- 96.0.50.226 — Same TLS certificate (https://ipdebrief.com/96.0.50.226)

---

Source: IPDebrief, "13.128.249.238 IP intelligence", https://ipdebrief.com/13.128.249.238, updated 2026-11-02. Assessments are probabilistic.