# 104.28.217.138 — IP Intelligence Summary

104.28.217.138 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to Utrecht, United States. As of October 6, 2026, IPDebrief rates it Moderate Risk (50/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/104.28.217.138
- Last updated: 2026-10-06

## Ownership

- Organization: Cloudflare, Inc.
- Network name: CLOUDFLARENET
- Allocated block: 104.16.0.0/12
- ASN: AS13335 (https://ipdebrief.com/asn/13335)
- Regional registry: ARIN

## Location

- City: Utrecht
- Region: Utrecht
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (50/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP INTELLIGENCE BRIEFING: 104.28.217.138/32

**Classification:** Cloudflare CDN Infrastructure Node

\## Executive Summary

Intellect 104.28.217.138 is a Cloudflare, Inc. (ASN 13335) Content Delivery Network endpoint operating within the CLOUDFLARENET infrastructure block (104.16.0.0/12). The IP carries a moderate risk score of 65/100. No active threat indicators or malicious indicators were identified. The subnet environment (104.28.217.0/24) shows zero abuse density with zero threat-adjacent siblings.

\## Ownership & Infrastructure

\- **Organization:** Cloudflare, Inc.

\- **ASN:** 13335 (CLOUDFLARENET)

\- **CIDR Block:** 104.16.0.0/12

\- **Registration Date:** July 14, 2010 (5,853 days)

\- **Geolocation:** Amsterdam, Netherlands (primary)

\- **Network Classification:** CDN Infrastructure

\- **Service Status:** Firewalled / No Services

\## Threat Profile

\- **Risk Score:** 65/100 (Moderate Risk)

\- **Abuse Confidence:** Not applicable (legitimate CDN infrastructure)

\- **Blacklist Status:** Zero listings

\- **Known Campaigns:** None detected

\- **Tor Exit Node:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\## Network Behavior

The IP exhibits no active services, with all ports appearing filtered. DNS infrastructure shows no PTR records, no forward resolution, and no email authentication records (SPF/DMARC). The BGP routing shows the prefix 104.28.217.0/24 with one route change in the past 30 days. Route stability is marked as false due to this change.

\## Neighborhood Analysis

Subnet 104.28.217.0/24 contains 5 total sibling IPs with the following risk distribution:

\- **High Risk:** 0

\- **Medium Risk:** 2 (104.28.217.137, 104.28.217.139)

\- **Low Risk:** 1 (104.28.217.140)

\- **Unknown:** 1 (104.28.217.210)

Subnet abuse density: 0. Classification: clean. No threat-adjacent siblings detected.

\## Historical Observations

Sixteen signal observations recorded. Recent analysis shows:

\- Clean classification maintained across all observations

\- Zero ownership changes

\- Zero threat persistence days

\- Zero threat observation count

\- Not persistently malicious

\## Relationship Graph

All detected relationships link to the CLOUDFLARENET network entity, confirming infrastructure consolidation within Cloudflare's CDN ecosystem. No connections to external organizations, hostnames, or certificates were identified.

\## Recommended Actions

**Priority:** MONITORING (High)

**Recommended Actions:**

1. Increase logging verbosity for traffic from this IP range

2. Review recent activity patterns against baseline CDN behavior

3. Implement firewall rules if legitimate service use is not expected

**Firewall Rules:**

\- **iptables:** \`iptables -A INPUT -s 104.28.217.138 -j DROP\`

\- **nftables:** \`nft add rule inet filter input ip saddr 104.28.217.138 drop\`

\- **nginx:** \`deny 104.28.217.138;\`

\- **pfSense:** \`104.28.217.138/32\`

\- **Cloudflare WAF:** Block with expression \`ip.src eq 104.28.217.138\`

\- **AWS WAF:** Add address \`104.28.217.138/32\`

**Note:** These recommendations are probabilistic. The IP operates as legitimate CDN infrastructure. Blocking is recommended only if the IP is not expected to generate legitimate traffic for your organization's services.

\## Analyst Notes

The elevated risk score (65) appears to be an artifact of the CDN infrastructure classification rather than malicious activity. The subnet shows no abuse patterns, and the IP is part of a long-established Cloudflare network. Analysts should verify expected CDN traffic patterns before implementing blocking measures.

## Nearby addresses

- 104.28.217.137 (https://ipdebrief.com/104.28.217.137)
- 104.28.217.139 (https://ipdebrief.com/104.28.217.139)
- 104.28.217.140 (https://ipdebrief.com/104.28.217.140)
- 104.28.217.188 (https://ipdebrief.com/104.28.217.188)
- 104.28.217.210 (https://ipdebrief.com/104.28.217.210)

---

Source: IPDebrief, "104.28.217.138 IP intelligence", https://ipdebrief.com/104.28.217.138, updated 2026-10-06. Assessments are probabilistic.