104.28.160.110📋 Copy

## IP Intelligence Briefing: 104.28.160.110

Classification: CDN Infrastructure Node (Cloudflare)

Report Date: Current Intelligence Cycle

---

Executive Summary

IP address 104.28.160.110 resolves to Cloudflare CDN infrastructure (ASN 13335) located in Bennett, Colorado, United States. The IP carries a moderate risk score of 55, primarily driven by DNSBL listings rather than active threat indicators. The address serves as a firewalled CDN endpoint with no accessible services. Neighborhood analysis indicates low abuse density within the /24 subnet.

Ownership and Infrastructure

Risk Assessment

Overall Risk Score: 55/100 (Moderate)

Risk Breakdown:

• Threat Indicators: None detected (no known campaigns, attacker attribution, or spam source)
• Blacklist Status: 3 listings across 8 total DNSBL feeds (max severity: high)
• Tor/Proxy: Not a Tor exit node, proxy, or VPN endpoint
• Known Attacker: False
• Spam Source: False

Technical Observations

Network Role:

• Anycast CDN infrastructure
• No residential, mobile, or hosting characteristics
• DNSSEC valid
• Route stability: Unstable

DNS Analysis:

• Forward resolution: Confirmed
• PTR records: None
• SPF/DMARC: Not configured (typical for CDN infrastructure)
• Hosted domains: 0

Services:

• Open ports: None
• TLS certificate: None exposed
• HTTP title: None exposed
• No WAF violations observed

Observation History

Twelve signal observations recorded. Recent activity (2026-07-22) shows:

• Consistent geolocation to Colorado, US
• DNSSEC validation confirmed
• DNSBL listings observed (3/8 lists)
• Subnet abuse density: 0.0345 (low)

No significant threat persistence or ownership changes detected.

Neighborhood Analysis (104.28.160.0/24)

Subnet Classification: Clean

Abuse Density: 0.0345

Notable High-Risk Neighbors:

• 104.28.160.7: Risk 70 (Authority 85)
• 104.28.160.188: Risk 55 (Authority 85)

Relationships

Relationship graph indicates only network-level associations (CLOUDFLARENET). No connections to external organizations, hostnames, or certificates beyond the parent CDN network.

Recommended Actions

Based on the risk profile and infrastructure classification:

1. No Immediate Blocking Recommended: This is legitimate CDN infrastructure with no active malicious indicators.

2. Allow List Consideration: Consider whitelisting if legitimate traffic to Cloudflare CDN is expected.

3. Monitoring: Monitor the associated /24 subnet for escalation in abuse density (currently 0.0345).

4. DNSBL Investigation: Review the 3 DNSBL listings to understand specific listing reasons if traffic patterns warrant.

SOC Analyst Notes

• Infrastructure Type: This is a Cloudflare CDN node. Blocking would likely impact legitimate traffic to cloudflare-hosted services.
• Risk Context: Moderate risk score reflects DNSBL presence in a high-volume CDN environment where false positives are common.
• Threat Context: No active threat indicators. The single "threat sibling" in the subnet is not directly correlated.
• Operational Recommendation: Maintain allow policies for CDN traffic. Investigate DNSBL listings only if this specific IP shows anomalous connection patterns.

---

Intelligence Source: IPDebrief Intelligence Platform

Data Freshness: Current (Real-time analysis)

Classification: Defensive Security Intelligence

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.