104.23.217.121
# IP Threat Intelligence Briefing
Target: 104.23.217.121/32
Classification: Low Risk / Legitimate Infrastructure
Date: Current
---
## Executive Summary
IP 104.23.217.121 is a Cloudflare CDN endpoint with a low-risk profile (risk score: 25). The IP belongs to the CLOUDFLARENET network (ASN 13335) and functions as part of Cloudflare's global infrastructure. No malicious indicators, blacklists, or threat campaigns associated with this address.
---
## Ownership and Geolocation
| Field | Value |
|---|---|
| Organization | Cloudflare, Inc. |
| ASN | 13335 |
| CIDR Block | 104.16.0.0/12 |
| RIR | ARIN |
| Country | Sweden (SE) |
| City | Stockholm |
The IP is part of Cloudflare's anycast CDN network, which routes traffic across multiple geographic locations. Geolocation data shows consensus in Stockholm County, though RTT measurements indicate traffic may traverse through Comcast networks.
---
## Network Profile
- Infrastructure Type: CDN (Content Delivery Network)
- Service Status: Firewalled / No Services
- Open Ports: None detected
- DNS Status: Forward resolution not confirmed
- TLS Certificates: None exposed
- Anycast: Enabled (standard for Cloudflare)
The IP has no active web services exposed directly. Services are typically proxied through Cloudflare's edge infrastructure.
---
## Threat Assessment
| Indicator | Status |
|---|---|
| Known Attacker | No |
| Tor Exit Node | No |
| Spam Source | No |
| Blacklist Count | 0 |
| Abuse Confidence | None |
| Threat Feeds | None |
| DNSBL Lists | 1 of 8 |
No threat indicators identified. The single DNSBL listing is attributed to Cloudflare's protective measures rather than abuse.
---
## Historical Observation (16 events)
Recent scans confirm:
- Traceroute completed successfully (15 hops)
- Port scans detected no open services
- Ownership consistently attributed to Cloudflare, Inc.
- No persistent malicious activity observed
- Average ownership days: Stable
No escalation in risk profile detected over observation period.
---
## Neighborhood Analysis
Subnet: 104.23.217.0/24
Abuse Density: 0 (Clean)
| Neighbor IP | Risk Score | Authority | Classification |
|---|---|---|---|
| 104.23.217.10 | 25 | 85 | Low Risk |
| 104.23.217.97 | 25 | 85 | Low Risk |
All sibling IPs in the /24 subnet exhibit low-risk profiles. The subnet shows no inherited risk and is classified as clean.
---
## Recommended Actions
| System | Rule Type | Configuration |
|---|---|---|
| Firewall / IDS | Allow (with logging) | Permit established Cloudflare traffic; monitor for anomalies |
| WAF | No action required | Standard Cloudflare WAF rules apply |
| Email Filtering | Standard | Treat as legitimate; no spam filtering required |
Note: Due to Cloudflare's CDN architecture, direct blocking is not recommended. If traffic from this IP exhibits anomalous behavior, apply granule inspection rather than blanket blocking.
---
## Intelligence Summary
104.23.217.121 is legitimate Cloudflare CDN infrastructure with no malicious indicators. The IP shows consistent behavior patterns, zero abuse history, and a clean subnet environment. No firewall rules or blocking actions are recommended. Standard Cloudflare traffic handling procedures apply.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Cloudflare, Inc. |
| ASN | AS13335 |
| Network Name | CLOUDFLARENET |
| CIDR Block | 104.16.0.0/12 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 27% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 19% | 2 | 2 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 2 |
| geolocation | 27% | 2 | 3 |
| Overall | 21% | 10 | 14 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-08-08 16:29:46 UTC |
| Last Seen | 2026-08-27 19:19:58 UTC |
| Profile Built | 2026-08-29 03:56:57 UTC |
| Data Freshness | Live |
| Signal Types | 18 |
| Total Observations | 20 |
Full dossier details are available via our API.