104.28.219.194📋 Copy

# IP Intelligence Briefing: 104.28.219.194/32

## Executive Summary

The target IP 104.28.219.194 is a Cloudflare CDN edge infrastructure address with a moderate risk score of 50. Analysis indicates this is a passive CDN node with no active services, no threat indicators, and no evidence of persistent malicious activity. The subnet overall maintains a clean classification with zero abuse density despite individual IP variance.

## Ownership & Infrastructure

• Organization: Cloudflare, Inc.
• ASN: 13335 (CLOUDFLARENET)
• CIDR Block: 104.16.0.0/12
• Network Role: Content Delivery Network (CDN)
• Geolocation: United States, Kansas City, Missouri (2500 km accuracy radius)

## Risk Assessment

Overall Risk Score: 50 (Moderate Risk)

Risk Breakdown:

• Provider Score: 0
• Authority Score: 0
• Stability Score: 0
• Abuse Confidence Score: Not applicable

Control Plane Analysis:

• DNSBL Listings: 2 of 8 total lists
• Route Stability: False
• RPKI State: Not applicable
• Operator Score: 0.1304 (Minimal)

## Neighborhood Analysis

Subnet: 104.28.219.0/24

• Total Siblings: 9
• Active Siblings: 1
• Threat Siblings: 0
• Abuse Density: 0 (Clean)

Neighbor Risk Distribution:

• High Risk: 0
• Medium Risk: 3
• Low Risk: 3

Neighbor IPs include: 104.28.219.140 (risk: 40), 104.28.219.190 (risk: 50), 104.28.219.191 (risk: 0), 104.28.219.192 (unresolved), 104.28.219.193 (risk: 25), 104.28.219.195 (risk: 40), 104.28.219.199 (unresolved), 104.28.219.244 (risk: 0)

## Threat Intelligence

Threat Indicators: None detected

• Is Tor Exit Node: No
• Is Known Attacker: No
• Is Spam Source: No
• Blacklist Count: 0
• Known Campaigns: None

DNS Analysis:

• Reverse DNS PTR Records: None
• Forward Resolution: Not confirmed
• Hosted Domains: 0

Services:

• Open Ports: None
• TLS Certificate: None
• HTTP Title: None
• Connection Type: Firewalled/No Services

## Observation History

Total Observations: 15 signals

• Ownership Changes: 0
• Threat Persistence Days: 0
• Is Persistently Malicious: False
• Threat Observation Count: 0

Recent observations confirm consistent Cloudflare ownership with no changes. Geolocation signals show multiple sources with confidence levels ranging from 0.35 to 0.90, indicating typical CDN geolocation variance.

## Relationships

The IP maintains relationships with the CLOUDFLARENET network entity. No external organizational or certificate associations detected.

## Recommended Actions

Note: Recommendations are probabilistic and should be combined with other signals before taking action.

Firewall Rules:

• iptables: `iptables -A INPUT -s 104.28.219.194 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 104.28.219.194 drop`
• nginx: `deny 104.28.219.194;`
• pfSense: `104.28.219.194/32`
• Cloudflare WAF: Block with expression `ip.src eq 104.28.219.194`
• AWS WAF: Add `104.28.219.194/32` to block list

## Intelligence Narrative

The IP 104.28.219.194 represents a Cloudflare CDN edge node. While the moderate risk score of 50 may trigger automated filtering systems, the absence of threat indicators, open ports, and active services suggests this is legitimate CDN infrastructure. The subnet abuse density of 0 indicates the broader network is clean, though individual IP variance exists. No evidence of malicious activity, persistent threats, or known campaign participation.

Recommendation: If traffic from this IP is observed, evaluate in context of application behavior. The moderate risk score reflects CDN infrastructure characteristics rather than confirmed malicious activity. Consider allowing traffic with monitoring unless additional threat indicators emerge.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.