104.28.156.213📋 Copy

# IP Intelligence Briefing: 104.28.156.213/32

## Executive Summary

IP 104.28.156.213 operates as a Cloudflare CDN endpoint within the 104.28.156.0/24 subnet. The address carries a low-risk score of 25 and is classified as "mostly_clean" within its neighborhood. No active threat indicators, blacklist entries, or known attacker associations were observed.

## Infrastructure Profile

Ownership & Provider:

• ASN: AS13335 (Cloudflare, Inc.)
• Organization: CLOUDFLARENET
• Registration: ARIN
• Infrastructure Type: CDN
• Network Classification: Firewalled / No Services

Geolocation:

• Primary Location: Hong Kong (HK)
• Geographic Consensus: Mixed data sources reported US and HK coordinates with 2500km accuracy radius
• Geographic Plausibility: False (multiple source conflicts)

Network Role:

• CDN Endpoint: Yes
• Cloud Service: No
• Proxy/VPN/Tor: No
• Anycast: No
• Mobile/Residential/Hosting: No

## Threat Assessment

Risk Metrics:

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not available
• Blacklist Count: 0
• DNSBL Lists: 1 of 8 total
• Known Campaigns: None detected

Threat Indicators:

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Threat Persistence Days: 0
• Persistently Malicious: No

Network Signals:

• Open Ports: None detected
• TLS Certificate: Not available
• HTTP Banner: Not available
• Email Auth: No SPF/DMARC records

## Neighborhood Context

Subnet Analysis (104.28.156.0/24):

• Total Siblings: 54
• Active Siblings: 19
• Threat Siblings: 4
• Abuse Density: 0.019
• Subnet Classification: mostly_clean

Risk Distribution:

• High Risk: 1 sibling
• Medium Risk: 12 siblings
• Low Risk: 23 siblings

Notable Neighbor IPs:

• 104.28.156.34 (Risk: 25, Authority: 85)
• 104.28.156.41 (Risk: 25, Authority: 85)
• 104.28.156.53 (Risk: 40, Authority: 85)
• 104.28.156.63 (Risk: 30, Authority: 85)

## Historical Observation

Observation Count: 15 signals recorded

Recent Activity:

• July 2026: CDN infrastructure signals confirmed
• ASN AS13335 cloudflare associations documented
• Geographic data conflicts between US and HK coordinates
• One threat observation noted in signal history
• No persistent malicious activity detected

Temporal Analysis:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: False

## Related Entities

Relationship Graph:

• Same Network: CLOUDFLARENET (3 relationships recorded)
• No external hostname, organization, or certificate associations detected

## Control Plane Data

Routing & Stability:

• BGP Prefix: 104.28.156.0/24
• Route Stable: False
• Route Changes (30d): 0
• MoAS: No
• RPKI State: Not available
• IRR Consistency: Not available

DNS Security:

• DNSSEC Valid: Yes
• CAA Records: No
• DNSBL Listed: 1/8

## Recommended Security Actions

Firewall Rules:

• No specific blocking recommendations (low-risk CDN endpoint)
• Standard CDN traffic patterns expected
• Monitor for unusual outbound connections from this IP

SOC Analyst Notes:

• This IP represents legitimate Cloudflare CDN infrastructure
• Low risk score with no active threat indicators
• Geographic inconsistencies require monitoring but do not indicate compromise
• Neighborhood shows typical CDN subnet risk distribution
• Standard allow-listing or monitoring appropriate

Priority: LOW

Classification: CDN Infrastructure / Legitimate Service

---

*Report generated via IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.