# 104.28.217.139 — IP Intelligence Summary

104.28.217.139 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to Utrecht, United States. It belongs to datacenter or hosting infrastructure. As of August 29, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/104.28.217.139
- Last updated: 2026-08-29

## Ownership

- Organization: Cloudflare, Inc.
- Network name: CLOUDFLARENET
- Allocated block: 104.16.0.0/12
- ASN: AS13335 (https://ipdebrief.com/asn/13335)
- Regional registry: ARIN

## Location

- City: Utrecht
- Region: Utrecht
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: CDN
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 104.28.217.139/32

\## Executive Summary

The IP address 104.28.217.139 is assigned to Cloudflare, Inc. (ASN 13335) and operates as part of the CLOUDFLARENET CDN infrastructure. The IP presents a moderate risk profile (score: 40) consistent with high-traffic CDN operations. No active threat indicators or malicious behavior observed.

\## Ownership and Network Classification

\- **Organization:** Cloudflare, Inc.

\- **ASN:** 13335 (CLOUDFLARENET)

\- **CIDR Block:** 104.16.0.0/12

\- **Network Role:** CDN (Content Delivery Network)

\- **Geolocation:** Netherlands (NL), Utrecht

\- **Registration:** ARIN, allocated 2010-07-14

\## Technical Profile

\- **Risk Score:** 40 (Moderate Risk)

\- **Abuse Confidence Score:** Null

\- **Network Status:** Firewalled / No Services

\- **Open Ports:** None detected

\- **DNS Resolution:** No forward resolution or PTR records

\- **HTTP/HTTPS:** No services running; no TLS certificate detected

\- **Control Plane:** Route changes observed in last 30 days (1 change). Listed on 2 of 8 DNSBLs (common for CDN infrastructure)

\## Threat Assessment

\- **Blacklist Count:** 0

\- **Tor Exit Node:** No

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Known Campaigns:** None

\- **Threat Feeds:** No indicators

\- **Campaign Likelihood:** None detected

\- **Certificate Matches:** 0

\- **Persistent Malicious Activity:** No

\## Neighborhood Analysis (104.28.217.0/24)

\- **Total Siblings:** 5 IPs in /24 subnet

\- **Abuse Density:** 0 (clean subnet)

\- **Risk Distribution:** 0 high, 2 medium, 1 low

\- **Neighbor Profiles:**

| IP Address | Risk Score | Authority Score |

|------------|------------|-----------------|

| 104.28.217.137 | 40 | 85 |

| 104.28.217.138 | 65 | 85 |

| 104.28.217.140 | 25 | 85 |

| 104.28.217.210 | N/A | N/A |

\## Historical Observations (Last 15 Signals)

Recent observations from 2026-07-23 indicate:

\- Subnet classification: Clean

\- ASN 13335 status: Assigned (age: 5,853 days)

\- Route stability: Not stable (1 change in 30-day window)

\- Threat persistence: None observed

\- Ownership changes: 0

\## Operational Relationships

\- **Network Affiliation:** CLOUDFLARENET (3 relationship entries)

\- **Related Entities:** No hostnames, organizations, or certificates identified

\## Recommended Actions

**SOC Analyst Guidance:**

\- **Block:** Not recommended. This is legitimate CDN infrastructure.

\- **Monitor:** Standard CDN traffic monitoring sufficient.

\- **Firewall Rules:** No specific blocking required. Allow standard CDN traffic patterns.

\- **Threat Hunt:** No active threats identified. The moderate risk score reflects CDN operational patterns, not malicious activity.

\## Conclusion

IP 104.28.217.139 is legitimate Cloudflare CDN infrastructure with no threat indicators. The moderate risk score and minor DNSBL listings are consistent with CDN operations rather than malicious activity. No defensive action required beyond standard CDN traffic handling.

## Nearby addresses

- 104.28.217.137 (https://ipdebrief.com/104.28.217.137)
- 104.28.217.138 (https://ipdebrief.com/104.28.217.138)
- 104.28.217.140 (https://ipdebrief.com/104.28.217.140)
- 104.28.217.188 (https://ipdebrief.com/104.28.217.188)
- 104.28.217.210 (https://ipdebrief.com/104.28.217.210)

---

Source: IPDebrief, "104.28.217.139 IP intelligence", https://ipdebrief.com/104.28.217.139, updated 2026-08-29. Assessments are probabilistic.