# 16.28.136.229 — IP Intelligence Summary

16.28.136.229 is an IPv4 address operated by Amazon Data Services South Africa (AS16509), geolocated to Cape Town, South Africa. Its reverse DNS name is ec2-16-28-136-229.af-south-1.compute.amazonaws.com. As of October 20, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/16.28.136.229
- Last updated: 2026-10-20

## Ownership

- Organization: Amazon Data Services South Africa
- Network name: AMAZON-CPT
- Allocated block: 16.28.0.0/16
- ASN: AS16509 (https://ipdebrief.com/asn/16509)
- Regional registry: ARIN
- Cloud / hosting provider: Amazon Web Services

## Location

- City: Cape Town
- Region: WC
- Country: South Africa
- Time zone: Africa/Johannesburg

## Network classification

- Infrastructure type: Unknown
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ec2-16-28-136-229.af-south-1.compute.amazonaws.com
- Forward-confirmed: yes

## Exposed services

- 443/tcp — https

## Analyst narrative

The IP address 16.28.136.229 was classified as High Risk with a score of 70 and was assigned to Amazon Data Services South Africa (ASN 16509) within the 16.28.0.0/16 block. Geolocation data indicated Cape Town, South Africa, although source consensus was inconsistent with conflicting US data. The address resolved to ec2-16-28-136-229.af-south-1.compute.amazonaws.com and presented an SSL certificate for lms-aws-af-south-1.roblox.com on port 443 via nginx.

Threat analysis identified the infrastructure as part of a coordinated campaign, correlating with 15 other IP addresses and certificate subjects. Despite a lack of specific behavioral incidents, the risk assessment flagged the address with critical severity due to the high risk score and correlation with known campaign infrastructure. Operational guidance advised immediate firewall blocking to mitigate potential exposure. One DNS blacklist listing was detected among eight checks.

## Addresses sharing infrastructure

- 13.244.182.253 — Same TLS certificate (https://ipdebrief.com/13.244.182.253)
- 13.244.207.199 — Same TLS certificate (https://ipdebrief.com/13.244.207.199)
- 13.244.250.134 — Same TLS certificate (https://ipdebrief.com/13.244.250.134)
- 13.245.142.122 — Same TLS certificate (https://ipdebrief.com/13.245.142.122)
- 13.245.248.54 — Same TLS certificate (https://ipdebrief.com/13.245.248.54)
- 13.247.239.151 — Same TLS certificate (https://ipdebrief.com/13.247.239.151)
- 15.240.4.31 — Same TLS certificate (https://ipdebrief.com/15.240.4.31)
- 15.240.106.189 — Same TLS certificate (https://ipdebrief.com/15.240.106.189)
- 15.240.141.162 — Same TLS certificate (https://ipdebrief.com/15.240.141.162)
- 15.240.222.238 — Same TLS certificate (https://ipdebrief.com/15.240.222.238)
- 16.28.121.18 — Same TLS certificate (https://ipdebrief.com/16.28.121.18)
- 16.28.129.0 — Same TLS certificate (https://ipdebrief.com/16.28.129.0)

---

Source: IPDebrief, "16.28.136.229 IP intelligence", https://ipdebrief.com/16.28.136.229, updated 2026-10-20. Assessments are probabilistic.