104.28.165.191📋 Copy

# IP Intelligence Briefing: 104.28.165.191/32

## Executive Summary

IP address 104.28.165.191 is identified as legitimate Cloudflare CDN infrastructure with a low-risk profile (Risk Score: 25). The IP exhibits no threat indicators and operates within a clean subnet environment.

## Ownership and Infrastructure

• Organization: Cloudflare, Inc. (ASN 13335)
• Network: CLOUDFLARENET (104.16.0.0/12)
• Classification: CDN / Content Delivery Network
• Geolocation: United States, Colorado, Bennett
• Registration: ARIN registry

## Risk Assessment

## Network Behavior

• Services: Firewall-walled; no open ports detected
• DNS Resolution: No PTR hostnames, no forward resolution
• Certificate Data: None detected
• HTTP Services: No services detected (expected for CDN edge)
• Status Code: Not applicable (firewalled)

## Threat Indicators

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Known Campaigns: None
• Blacklist Status: Not listed on any feeds
• Malicious Activity: None observed

## Historical Observations

Analysis of 16 observations (as of July 29, 2026) reveals:

• Ownership Stability: 0 changes detected
• Threat Persistence: 0 days
• Threat Observations: 0
• Persistent Malicious Activity: False
• Geolocation Validation: ICMP blocked (unable to validate)
• Subnet Classification: Clean (abuse density: 0)

## Subnet Analysis (104.28.165.0/24)

• Total Neighbors: 50
• Abuse Density: 0.06 (low)
• Risk Distribution: 3 high-risk, 23 medium-risk, 22 low-risk
• Classification: Clean subnet
• Threat Siblings: 0

Notable neighbors include:

• 104.28.165.9 (Risk: 0, Authority: 85)
• 104.28.165.15 (Risk: 0, Authority: 85)
• 104.28.165.52 (Risk: 55, Authority: 85)

## Network Relationships

All 6 relationship links point to "CLOUDFLARENET" network, confirming legitimate Cloudflare infrastructure integration.

## Recommended Actions

Allow (Recommended)

This IP represents legitimate CDN infrastructure. Standard action is to allow traffic for normal web operations:

```bash

# Allow standard HTTPS/HTTP traffic

iptables -A INPUT -p tcp -d 104.28.165.191 --dports 443,80 -j ACCEPT

```

No Blocking Required

• No firewall rules recommended for blocking
• No threat indicators present
• Cloudflare CDN infrastructure requires allow rules for legitimate traffic

Monitoring

• Monitor for unusual traffic patterns
• Verify expected CDN traffic volumes
• Track subnet for any changes in reputation

## Conclusion

IP 104.28.165.191 is identified as legitimate Cloudflare CDN infrastructure with no threat indicators. The IP is classified as Low Risk and operates within a clean subnet environment. No blocking actions recommended; standard allow rules for CDN traffic apply.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.