# 3.228.228.94 — IP Intelligence Summary

3.228.228.94 is an IPv4 address operated by Amazon Data Services Northern Virginia (AS16509), geolocated to Ashburn, United States. Its reverse DNS name is ec2-3-228-228-94.compute-1.amazonaws.com. As of November 1, 2026, IPDebrief rates it High Risk (70/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/3.228.228.94
- Last updated: 2026-11-01

## Ownership

- Organization: Amazon Data Services Northern Virginia
- Network name: AMAZON-IAD
- Allocated block: 3.224.0.0/12
- ASN: AS16509 (https://ipdebrief.com/asn/16509)
- Regional registry: ARIN
- Cloud / hosting provider: Amazon Web Services

## Location

- City: Ashburn
- Region: VA
- Country: United States
- Time zone: America/New_York

## Network classification

- Infrastructure type: Unknown
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: High Risk (70/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Reverse DNS

- ec2-3-228-228-94.compute-1.amazonaws.com
- Forward-confirmed: yes

## Exposed services

- 443/tcp — https
- 8443/tcp — https-alt

## Analyst narrative

The IP address 3.228.228.94 is allocated to Amazon Web Services in Ashburn, VA, though geolocation metrics contradict the claimed physical distance. It is classified as "Campaign Infrastructure" with a critical severity risk score of 70 and is listed on eight DNS blacklists. While it resolves to an AWS compute hostname with HTTPS services, it correlates with 43 certificate matches and high threat actor activity. Due to the strong threat evidence, the recommended action is to block traffic from this IP.

## Nearby addresses

- 3.228.228.84 (https://ipdebrief.com/3.228.228.84)

## Addresses sharing infrastructure

- 3.83.58.73 — Same TLS certificate (https://ipdebrief.com/3.83.58.73)
- 3.208.58.188 — Same TLS certificate (https://ipdebrief.com/3.208.58.188)
- 3.208.65.173 — Same TLS certificate (https://ipdebrief.com/3.208.65.173)
- 3.208.141.112 — Same TLS certificate (https://ipdebrief.com/3.208.141.112)
- 3.212.16.54 — Same TLS certificate (https://ipdebrief.com/3.212.16.54)
- 3.214.183.82 — Same TLS certificate (https://ipdebrief.com/3.214.183.82)
- 3.219.135.88 — Same TLS certificate (https://ipdebrief.com/3.219.135.88)
- 3.231.62.33 — Same TLS certificate (https://ipdebrief.com/3.231.62.33)
- 18.211.175.205 — Same TLS certificate (https://ipdebrief.com/18.211.175.205)
- 32.194.203.123 — Same TLS certificate (https://ipdebrief.com/32.194.203.123)
- 32.197.118.179 — Same TLS certificate (https://ipdebrief.com/32.197.118.179)
- 32.199.135.194 — Same TLS certificate (https://ipdebrief.com/32.199.135.194)

---

Source: IPDebrief, "3.228.228.94 IP intelligence", https://ipdebrief.com/3.228.228.94, updated 2026-11-01. Assessments are probabilistic.