104.28.165.71📋 Copy

# IP INTELLIGENCE BRIEFING

Target IP: 104.28.165.71/32

Date: 2026-07-29

Classification: LOW RISK – CDN Infrastructure

---

## EXECUTIVE SUMMARY

Target IP 104.28.165.71 is a Cloudflare CDN endpoint with a risk score of 25 (Low Risk). The IP is part of Cloudflare's CLOUDFLARENET infrastructure (ASN 13335) and shows no malicious indicators. Subnet analysis indicates clean classification with minimal abuse density. No immediate defensive actions recommended.

---

## INFRASTRUCTURE PROFILE

---

## THREAT INDICATOR ASSESSMENT

• Risk Score: 25 / 100 (Low)
• Reputation: Low Risk
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Abuse Confidence Score: Not applicable (CDN infrastructure)

Threat Feeds: No matches across Pulsedive, threat feeds, or known campaigns.

---

## NEIGHBORHOOD ANALYSIS (104.28.165.0/24)

• Total Sibling IPs: 50
• Abuse Density: 0.06 (6%) – Below threshold for concern
• Subnet Classification: Clean
• Risk Distribution:

- High Risk: 3 IPs

- Medium Risk: 23 IPs

- Low Risk: 22 IPs

Target IP Context: Risk score of 0 within subnet analysis, indicating the IP is operating normally within the CDN cluster.

---

## OBSERVATION HISTORY (16 Signals)

Recent Activity (2026-07-29):

• Geo-validation: ICMP blocked, geo-plausible validation confirmed (US, New York)
• No ownership changes detected
• No threat persistence observed
• Classification remains "clean"
• No certificate or banner anomalies

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Not Persistently Malicious: Confirmed

---

## RELATIONSHIP MAPPING

All 6 relationship indicators map to CLOUDFLARENET (Same Network). No external entity associations detected. The IP operates within Cloudflare's controlled infrastructure.

---

## RECOMMENDED ACTIONS

Current Risk Level: LOW

Action Required: None

Firewall Rules: No rules recommended

Context: As a Cloudflare CDN endpoint, this IP is expected to show no direct services (firewalled). Traffic to/from this IP should be permitted per normal CDN traffic patterns. No blocking or rate-limiting required absent specific attack correlation.

---

## SOC DECISION POINTS

1. Allow Standard CDN Traffic: Permit HTTP/HTTPS traffic through this IP

2. Monitor for Anomalies: No baseline deviation observed

3. No Immediate Mitigation: Risk profile consistent with legitimate CDN operations

Confidence Level: HIGH – Data from 16 observations, no conflicting signals detected.

---

*Intelligence generated from IPDebrief platform data. Combine with other telemetry before operational decisions.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.