104.28.233.73📋 Copy

# IP Intelligence Briefing: 104.28.233.73

## Executive Summary

IP address 104.28.233.73 is a Cloudflare CDN infrastructure endpoint with a high-risk reputation score of 80. The IP is classified as CDN infrastructure with firewalled/no services detected. While the IP itself shows no direct threat indicators, it is listed on 4 of 8 DNS blacklists, indicating potential reputation issues associated with Cloudflare's CDN services or abuse patterns.

## Technical Profile

Ownership & Registration:

• ASN: 13335 (Cloudflare, Inc.)
• Organization: Cloudflare, Inc.
• RIR: ARIN
• Network: CLOUDFLARENET

Geolocation:

• Country: United States (US)
• Region: California (CA)
• City: San Jose
• Location Accuracy: 2500km radius

Network Classification:

• Infrastructure Type: CDN
• Connection Type: Firewalled / No Services
• Is Cloud: No
• Is CDN: Yes
• Is Anycast: No

## Threat Indicators

Risk Assessment:

• Overall Risk Score: 80 (High Risk)
• Reputation: High Risk
• DNSBL Listed: 4 of 8 total lists
• Threat Indicators: None detected
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No

Operational Characteristics:

• Operator Score: 0.1304 (Minimal)
• Route Stability: Unstable
• RPKI State: Not evaluated
• IRR Consistency: Not evaluated

## Historical Observations

A total of 18 observations recorded between June 17-19, 2026. Key observations include:

• June 17, 2026: Alienvault OTX signal detected with 50 pulse matches
• Subnet analysis showed clean classification with 0 abuse density
• Operator score remained consistent at 0.1304
• No persistent malicious activity detected

## Network Relationships

• Primary Association: CLOUDFLARENET (22 relationship entries)
• Same Network: Multiple entries confirming Cloudflare infrastructure placement
• Campaign Correlation: No campaign matches or correlated IPs

## Neighborhood Analysis

Subnet: 104.28.233.0/24

• Abuse Density: 0 (Clean)
• Classification: Clean
• Total Siblings: 2
• Active Siblings: 2
• Threat Siblings: 0
• Neighbor Risk Distribution: 1 low-risk IP detected (104.28.233.181, Risk Score: 25)

## Recommended Actions

1. Monitor DNSBL Status: Investigate why this Cloudflare CDN IP is listed on 4 DNS blacklists. This may indicate abuse patterns or false positives.

2. Traffic Analysis: Review inbound/outbound traffic patterns to determine if this IP is being used in malicious contexts despite CDN classification.

3. False Positive Investigation: Verify if blacklist entries are legitimate or require challenge/appeal.

4. Continue Monitoring: Track any changes in risk profile or emergence of additional threat indicators.

## Intelligence Note

This IP represents legitimate Cloudflare CDN infrastructure with an elevated risk score, likely due to DNS blacklist associations rather than direct malicious activity. SOC analysts should distinguish between infrastructure-based reputation issues and active threat indicators. The absence of direct threat indicators, combined with clean subnet abuse density, suggests this is an infrastructure-level reputation concern rather than an active attack source.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.