104.22.104.180📋 Copy

# IP Intelligence Briefing: 104.22.104.180/32

## Executive Summary

104.22.104.180 is a legitimate Cloudflare CDN infrastructure IP with a low risk profile (Risk Score: 30). The address belongs to Cloudflare, Inc. (ASN 13335) and operates within the US (Virginia/Ashburn) network. No active threat indicators detected. Recommended action: Allow with standard CDN egress policies.

## Ownership and Infrastructure

• Organization: Cloudflare, Inc.
• ASN: 13335 (Cloudflare)
• Infrastructure Type: CDN (Content Delivery Network)
• Network Classification: CDN, Cloud Infrastructure
• Route Stability: Valid RPKI state, stable routing for 5,792 days
• BGP Prefix: 104.22.104.0/24

## Geographic Location

• Country: United States (US)
• Region: Virginia (VA)
• City: Ashburn
• Geo Confidence: 85% confidence via multiple sources

## Risk Assessment

• Overall Risk Score: 30 (Low Risk)
• Provider Score: 0
• Authority Score: 0
• Abuse Confidence: None detected
• Threat Indicators: None
• Blacklist Count: 0 active blacklists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

## Network Behavior Analysis

• Open Ports: None detected
• TLS Certificates: None detected
• HTTP Services: None detected
• DNS Resolution: No forward resolution
• PTR Records: None detected
• Email Authentication: SPF/DMARC not configured (typical for CDN infrastructure)

## Neighborhood Context

The /24 subnet (104.22.104.0/24) contains 25 sibling IPs with uniform risk characteristics:

• All 24 neighboring IPs show risk score: 30, authority score: 85
• Subnet abuse density flagged as "high_abuse" (40 inherited risk)
• This classification is attributable to Cloudflare CDN infrastructure patterns rather than malicious activity
• No active threat siblings detected

## Historical Observations (27 signals)

• Most Recent: June 19, 2026 – Operator score: 0.4783 (Basic)
• Routing Signals: Valid RPKI, stable routes
• CDN Classification: Consistently identified as Cloudflare CDN
• Threat Persistence: 0 days (not persistently malicious)
• Observation Count: 1 threat observation (likely legitimate CDN egress)

## Security Recommendations

No firewall blocking or blocking rules recommended. This IP operates as legitimate CDN infrastructure. Standard SOC guidance:

1. Allow traffic from this IP address through web application firewalls

2. Monitor for unusual egress patterns from internal networks to this destination

3. Verify that this IP is being used for legitimate CDN traffic (expected behavior for Cloudflare)

4. No action required for this IP based on current threat intelligence

## Evidence Summary

• Control plane validation: Valid RPKI, stable routing
• DNSSEC: Valid
• Route changes (30 days): 0
• MOAS status: Not a malware origin system
• ISP/Operator score: 0.4783 (Basic)

---

*Intelligence generated by IPDebrief. For SOC integration, reference Cloudflare CDN infrastructure patterns when evaluating similar risk scores.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.