104.22.56.26📋 Copy

# Intelligence Briefing: 104.22.56.26/32

Classification: LOW RISK – CDN Infrastructure

Date: 2026-06-20

Analyst: IPDebrief SOC Intelligence

---

## Executive Summary

IP 104.22.56.26 is a Cloudflare, Inc. CDN endpoint (ASN 13335) operating with a low-risk profile. No active threat indicators or malicious behavior detected. The IP represents legitimate cloud infrastructure with stable routing and minimal abuse exposure.

---

## Risk Assessment

---

## Infrastructure Profile

Ownership: Cloudflare, Inc. (ASN 13335)

Network Role: Content Delivery Network (CDN)

Infrastructure Type: CDN

Geolocation: United States (Atlanta, GA)

CIDR Block: 104.22.56.0/24

BGP Prefix: 104.22.56.0/24

Route Stability: Stable (0 route changes in 30 days)

RPKI State: Unknown

DNS & Email:

• DNSSEC Valid: Yes
• DNSBL Listings: 1 of 8 (minor exposure)
• SPF/DMARC: Not configured
• PTR Records: None detected

Services:

• Open Ports: None detected
• TLS Certificates: None exposed
• HTTP Services: None active

---

## Threat Indicators

Active Threat Signals: None

• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Active Threat Feeds: Empty
• Blacklist Count: 0
• Known Campaigns: None

DNSBL Exposure: 1 listing (minimal impact on 8 total lists)

---

## Neighborhood Analysis

Subnet: 104.22.56.0/24

Abuse Density: Low

Classification: Mostly Clean

Threat Siblings: 1 detected

Active Siblings: 0

Neighbor Count: 0

The immediate /24 neighborhood shows minimal abuse density, consistent with Cloudflare's infrastructure operations.

---

## Relationship Graph

Primary Associations:

• Multiple relationships to CLOUDFLARENET network
• 38 total relationship nodes identified
• All relationships indicate network-level cloud infrastructure

---

## Historical Observations

Total Signals Observed: 26

Observation Period: Recent (2026-06-20)

Key Signals:

• Port scans detected (no open ports confirmed)
• RTT geolocation discrepancies noted (claimed Atlanta, actual RTT suggests different origin)
• Operator risk assessment: Minimal (0.1304)
• No persistent malicious behavior detected
• No ownership changes observed

Geolocation Validation:

• RTT violation flagged: 38ms RTT below minimum possible 143.3ms for 7165km distance
• GeoPlausibility: False
• Multiple geo sources indicate US positioning

---

## Recommended Actions

Firewall Rules: None required

Threat Mitigation: No action needed

Monitoring: Standard CDN traffic monitoring sufficient

Actionable Intelligence:

1. No blocking recommended – legitimate CDN infrastructure

2. No port-level restrictions needed

3. Standard Cloudflare CDN traffic handling applies

4. Monitor for any changes in threat indicators

---

## SOC Analyst Notes

This IP represents standard Cloudflare CDN infrastructure with no evidence of malicious activity. The low risk score (25), absence of open services, and established network role indicate legitimate cloud operations. The single DNSBL listing likely reflects normal CDN blocking practices for abusive traffic rather than IP compromise.

Threat Confidence: Low – Standard Cloudflare endpoint

Action Priority: Routine monitoring only

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.