104.28.217.139📋 Copy

# IP Intelligence Briefing: 104.28.217.139/32

## Executive Summary

The IP address 104.28.217.139 is assigned to Cloudflare, Inc. (ASN 13335) and operates as part of the CLOUDFLARENET CDN infrastructure. The IP presents a moderate risk profile (score: 40) consistent with high-traffic CDN operations. No active threat indicators or malicious behavior observed.

## Ownership and Network Classification

• Organization: Cloudflare, Inc.
• ASN: 13335 (CLOUDFLARENET)
• CIDR Block: 104.16.0.0/12
• Network Role: CDN (Content Delivery Network)
• Geolocation: Netherlands (NL), Utrecht
• Registration: ARIN, allocated 2010-07-14

## Technical Profile

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence Score: Null
• Network Status: Firewalled / No Services
• Open Ports: None detected
• DNS Resolution: No forward resolution or PTR records
• HTTP/HTTPS: No services running; no TLS certificate detected
• Control Plane: Route changes observed in last 30 days (1 change). Listed on 2 of 8 DNSBLs (common for CDN infrastructure)

## Threat Assessment

• Blacklist Count: 0
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Known Campaigns: None
• Threat Feeds: No indicators
• Campaign Likelihood: None detected
• Certificate Matches: 0
• Persistent Malicious Activity: No

## Neighborhood Analysis (104.28.217.0/24)

• Total Siblings: 5 IPs in /24 subnet
• Abuse Density: 0 (clean subnet)
• Risk Distribution: 0 high, 2 medium, 1 low
• Neighbor Profiles:

| IP Address | Risk Score | Authority Score |

|------------|------------|-----------------|

| 104.28.217.137 | 40 | 85 |

| 104.28.217.138 | 65 | 85 |

| 104.28.217.140 | 25 | 85 |

| 104.28.217.210 | N/A | N/A |

## Historical Observations (Last 15 Signals)

Recent observations from 2026-07-23 indicate:

• Subnet classification: Clean
• ASN 13335 status: Assigned (age: 5,853 days)
• Route stability: Not stable (1 change in 30-day window)
• Threat persistence: None observed
• Ownership changes: 0

## Operational Relationships

• Network Affiliation: CLOUDFLARENET (3 relationship entries)
• Related Entities: No hostnames, organizations, or certificates identified

## Recommended Actions

SOC Analyst Guidance:

• Block: Not recommended. This is legitimate CDN infrastructure.
• Monitor: Standard CDN traffic monitoring sufficient.
• Firewall Rules: No specific blocking required. Allow standard CDN traffic patterns.
• Threat Hunt: No active threats identified. The moderate risk score reflects CDN operational patterns, not malicious activity.

## Conclusion

IP 104.28.217.139 is legitimate Cloudflare CDN infrastructure with no threat indicators. The moderate risk score and minor DNSBL listings are consistent with CDN operations rather than malicious activity. No defensive action required beyond standard CDN traffic handling.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.