104.23.201.126📋 Copy

# IP Intelligence Briefing: 104.23.201.126

## Executive Summary

IP 104.23.201.126 is a Cloudflare CDN infrastructure endpoint with a low-risk profile (Risk Score: 20). No active threat indicators detected. Recommended action: Allow with monitoring.

## Ownership and Infrastructure

• Organization: Cloudflare, Inc.
• ASN: 13335 (CLOUDFLARENET)
• CIDR Block: 104.16.0.0/12
• Classification: CDN (Content Delivery Network)
• Registration: ARIN
• Abuse Contact: abuse@cloudflare.com

## Risk Assessment

• Overall Risk Score: 20 (Low Risk)
• Abuse Confidence Score: Not available
• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None

## Network Role

• Infrastructure Type: CDN
• Connection Type: Firewalled/No Services
• Anycast: Yes (Cloudflare operates Anycast network)
• Open Ports: None detected
• TLS Certificate: Not available

## Geolocation

• Country: United States (US)
• Region: Minnesota
• City: Minneapolis
• Accuracy Radius: 2500 km
• GeoValidation Status: Implausible (RTT violation detected)

- Observed RTT: 44.2ms

- Minimum Possible RTT for claimed distance (6771km): 135.4ms

## Historical Signals (13 observations)

• Most Recent: 2026-08-13
• Observation Types: Geolocation, ownership, network classification
• Threat Persistence Days: 0
• Ownership Changes: 0
• Persistently Malicious: No
• Threat Observation Count: 0

## Neighborhood Analysis (Subnet: 104.23.201.0/24)

• Abuse Density: 0
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0
• Neighbor Risk Distribution: 1 low-risk neighbor (104.23.201.127, Risk Score: 25)

## Relationships

• Network Affiliation: CLOUDFLARENET (2 relationships)
• Related Entities: Limited to network-level associations

## Recommended Actions

Based on the low-risk profile and CDN infrastructure role:

• No immediate blocking recommended
• Allow traffic with standard CDN inspection
• Monitor for unusual patterns (standard practice)

## Threat Intelligence Narrative

IP 104.23.201.126 represents legitimate Cloudflare CDN infrastructure. The IP exhibits characteristics of a commercial CDN service provider with no associated threat indicators. The geolocation discrepancy (RTT violation) is consistent with Cloudflare's Anycast routing architecture, where traffic is routed to the nearest PoP regardless of claimed physical location. No malicious activity, blacklist entries, or campaign associations detected in the observation history. The subnet shows minimal abuse density with only one neighboring IP (104.23.201.127) exhibiting a low-risk profile. Standard CDN traffic patterns are expected; no firewall restrictions recommended beyond organizational policy for CDN traffic.

Classification: Benign Infrastructure

Threat Level: Low

Recommended Handling: Allow with logging

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.