# 104.28.219.194 — IP Intelligence Summary 104.28.219.194 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to Kansas City, United States. It belongs to datacenter or hosting infrastructure. As of October 5, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/104.28.219.194 - Last updated: 2026-10-05 ## Ownership - Organization: Cloudflare, Inc. - Network name: CLOUDFLARENET - Allocated block: 104.16.0.0/12 - ASN: AS13335 (https://ipdebrief.com/asn/13335) - Regional registry: ARIN ## Location - City: Kansas City - Region: Missouri - Country: United States - Time zone: — ## Network classification - Infrastructure type: CDN - Datacenter / hosting: yes - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP Intelligence Briefing: 104.28.219.194/32 \## Executive Summary The target IP 104.28.219.194 is a Cloudflare CDN edge infrastructure address with a moderate risk score of 50. Analysis indicates this is a passive CDN node with no active services, no threat indicators, and no evidence of persistent malicious activity. The subnet overall maintains a clean classification with zero abuse density despite individual IP variance. \## Ownership & Infrastructure \- **Organization:** Cloudflare, Inc. \- **ASN:** 13335 (CLOUDFLARENET) \- **CIDR Block:** 104.16.0.0/12 \- **Network Role:** Content Delivery Network (CDN) \- **Geolocation:** United States, Kansas City, Missouri (2500 km accuracy radius) \## Risk Assessment **Overall Risk Score:** 50 (Moderate Risk) **Risk Breakdown:** \- Provider Score: 0 \- Authority Score: 0 \- Stability Score: 0 \- Abuse Confidence Score: Not applicable **Control Plane Analysis:** \- DNSBL Listings: 2 of 8 total lists \- Route Stability: False \- RPKI State: Not applicable \- Operator Score: 0.1304 (Minimal) \## Neighborhood Analysis **Subnet:** 104.28.219.0/24 \- **Total Siblings:** 9 \- **Active Siblings:** 1 \- **Threat Siblings:** 0 \- **Abuse Density:** 0 (Clean) **Neighbor Risk Distribution:** \- High Risk: 0 \- Medium Risk: 3 \- Low Risk: 3 Neighbor IPs include: 104.28.219.140 (risk: 40), 104.28.219.190 (risk: 50), 104.28.219.191 (risk: 0), 104.28.219.192 (unresolved), 104.28.219.193 (risk: 25), 104.28.219.195 (risk: 40), 104.28.219.199 (unresolved), 104.28.219.244 (risk: 0) \## Threat Intelligence **Threat Indicators:** None detected \- Is Tor Exit Node: No \- Is Known Attacker: No \- Is Spam Source: No \- Blacklist Count: 0 \- Known Campaigns: None **DNS Analysis:** \- Reverse DNS PTR Records: None \- Forward Resolution: Not confirmed \- Hosted Domains: 0 **Services:** \- Open Ports: None \- TLS Certificate: None \- HTTP Title: None \- Connection Type: Firewalled/No Services \## Observation History **Total Observations:** 15 signals \- **Ownership Changes:** 0 \- **Threat Persistence Days:** 0 \- **Is Persistently Malicious:** False \- **Threat Observation Count:** 0 Recent observations confirm consistent Cloudflare ownership with no changes. Geolocation signals show multiple sources with confidence levels ranging from 0.35 to 0.90, indicating typical CDN geolocation variance. \## Relationships The IP maintains relationships with the CLOUDFLARENET network entity. No external organizational or certificate associations detected. \## Recommended Actions **Note:** Recommendations are probabilistic and should be combined with other signals before taking action. **Firewall Rules:** \- iptables: \`iptables -A INPUT -s 104.28.219.194 -j DROP\` \- nftables: \`nft add rule inet filter input ip saddr 104.28.219.194 drop\` \- nginx: \`deny 104.28.219.194;\` \- pfSense: \`104.28.219.194/32\` \- Cloudflare WAF: Block with expression \`ip.src eq 104.28.219.194\` \- AWS WAF: Add \`104.28.219.194/32\` to block list \## Intelligence Narrative The IP 104.28.219.194 represents a Cloudflare CDN edge node. While the moderate risk score of 50 may trigger automated filtering systems, the absence of threat indicators, open ports, and active services suggests this is legitimate CDN infrastructure. The subnet abuse density of 0 indicates the broader network is clean, though individual IP variance exists. No evidence of malicious activity, persistent threats, or known campaign participation. **Recommendation:** If traffic from this IP is observed, evaluate in context of application behavior. The moderate risk score reflects CDN infrastructure characteristics rather than confirmed malicious activity. Consider allowing traffic with monitoring unless additional threat indicators emerge. ## Nearby addresses - 104.28.219.97 (https://ipdebrief.com/104.28.219.97) - 104.28.219.140 (https://ipdebrief.com/104.28.219.140) - 104.28.219.150 (https://ipdebrief.com/104.28.219.150) - 104.28.219.151 (https://ipdebrief.com/104.28.219.151) - 104.28.219.152 (https://ipdebrief.com/104.28.219.152) - 104.28.219.190 (https://ipdebrief.com/104.28.219.190) - 104.28.219.191 (https://ipdebrief.com/104.28.219.191) - 104.28.219.192 (https://ipdebrief.com/104.28.219.192) - 104.28.219.193 (https://ipdebrief.com/104.28.219.193) - 104.28.219.195 (https://ipdebrief.com/104.28.219.195) - 104.28.219.199 (https://ipdebrief.com/104.28.219.199) - 104.28.219.244 (https://ipdebrief.com/104.28.219.244) --- Source: IPDebrief, "104.28.219.194 IP intelligence", https://ipdebrief.com/104.28.219.194, updated 2026-10-05. Assessments are probabilistic.