104.28.160.216📋 Copy

INTELLIGENCE BRIEFING: 104.28.160.216/32

Classification: Cloudflare CDN Endpoint - Low Threat Posture

---

EXECUTIVE SUMMARY

IP address 104.28.160.216 is identified as a Cloudflare CDN infrastructure endpoint with a moderate risk score of 40. The IP belongs to CLOUDFLARENET (ASN 13335), operating within the 104.16.0.0/12 CIDR block. No active threat indicators were detected; the IP serves as a firewalled CDN endpoint with no open services.

---

RISK PROFILE

Overall Risk Score: 40 (Moderate)

• Provider Score: 0
• Authority Score: 0
• Abuse Confidence: Not applicable

Risk Factors:

• 2 DNSBL listings detected out of 8 total lists
• No active threat indicators
• No known attacks, spam, or Tor exit point activity

Mitigating Factors:

• Legitimate Cloudflare CDN infrastructure
• No open ports or services exposed
• No known malicious campaigns associated
• Stable network ownership

---

GEOLLOCATION & NETWORK CONTEXT

Reported Location: South Korea (KR)

• Coordinates: 37.51°N, 126.97°E
• Timezone: Asia/Seoul
• Note: Geolocation data shows some inconsistency with expected US-based Cloudflare infrastructure. This is typical for CDN endpoint reporting due to anycast routing.

Network Classification:

• ASN: 13335 (CLOUDFLARENET)
• Organization: Cloudflare, Inc.
• Infrastructure Type: CDN
• Connection Type: Firewalled / No Services

---

THREAT INDICATORS

Active Indicators: None

• Blacklist Count: 0
• Tor Exit Point: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None

DNSBL Status:

• Listed: 2 out of 8 DNSBLs
• Severity: High (per recent observation)
• Impact: Minimal for CDN infrastructure; commonly listed for rate limiting or protocol compliance reasons

---

OBSERVATION HISTORY

Signal Count: 10 observations (most recent: 2026-07-22)

Key Historical Signals:

• DNSSEC validation confirmed
• ASN consistently reported as CLOUDFLARENET
• Geo signals indicate South Korea region
• Multiple DNS listing events with high-severity ratings
• PTR records: Not available (typical for CDN infrastructure)

---

SUBNET ANALYSIS (104.28.160.0/24)

Neighborhood: 28 sibling IPs in /24 subnet

Abuse Density: 0 (low)

Risk Distribution:

• High Risk: 0
• Medium Risk: 9
• Low Risk: 10
• Unprobed: 9

Highest-Risk Neighbors:

• 104.28.160.7 (Risk: 70)
• 104.28.160.110 (Risk: 55)
• 104.28.160.188 (Risk: 55)

Assessment: Subnet exhibits typical CDN risk distribution with no concentrated abuse patterns.

---

RELATIONSHIP GRAPH

Identified Relationships: 2

• Both relationships map to CLOUDFLARENET network
• No external organizational or certificate associations detected

---

RECOMMENDED ACTIONS

Security Posture: ACCEPT/MONITOR

• No blocking recommended for this IP
• Standard CDN egress traffic should be permitted
• Monitor for behavioral anomalies in application logs

Firewall Rules: None required

• This is legitimate CDN infrastructure
• No specific iptables/nftables rules needed
• Standard Cloudflare traffic policies apply

SOC Analyst Notes:

• This IP is part of Cloudflare's global CDN network
• Moderate risk score reflects DNSBL listings, which are common for CDN endpoints
• No immediate threat indicators present
• Subnet shows healthy distribution with no abuse concentration
• Treat as legitimate infrastructure; no defensive action required

---

END OF BRIEFING

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.