162.158.94.171
# IP Intelligence Briefing: 162.158.94.171
Classification: Cloudflare CDN Infrastructure (Low Risk)
Date: 2026-08-12
Prepared For: SOC Analysis
## Executive Summary
IP 162.158.94.171 is identified as Cloudflare CDN infrastructure (ASN 13335, CLOUDFLARENET) with a low-risk profile. The address shows no active threat indicators, no blacklist presence, and no association with known malicious campaigns. The subnet exhibits moderate abuse density (0.6667) but remains classified as "mostly_clean."
## Risk Assessment
| Metric | Value | Assessment |
|---|---|---|
| Risk Score | 25 | Low |
| Provider Score | 0 | Neutral |
| Authority Score | 0 | Neutral |
| Blacklist Count | 0 | Clean |
| Abuse Confidence | N/A | Not flagged |
## Infrastructure Profile
- Organization: Cloudflare, Inc.
- Network: 162.158.0.0/15 (CLOUDFLARENET)
- Infrastructure Type: CDN
- Geolocation: US (geo validation anomaly detected)
- DNS: No forward resolution, no PTR records
- Services: Firewalled / No Services exposed
## Threat Indicators
- Tor Exit Node: No
- Known Attacker: No
- Spam Source: No
- Campaign Association: None
- DNSBL Listings: 1 of 8 tested lists
- RPKI State: Valid
- Route Stability: Not stable (1 route change in 30 days)
## Neighborhood Analysis
The /24 subnet (162.158.94.0/24) contains 3 active siblings:
- 162.158.94.170: Risk Score 15
- 162.158.94.235: Risk Score 25
- 162.158.94.171: Risk Score 25 (subject IP)
Abuse density is elevated relative to typical CDN infrastructure but consistent with Cloudflare's shared network characteristics.
## Observation History
28 total observations collected. Recent signals confirm:
- CDN infrastructure classification (confidence 0.85-0.90)
- Cloudflare provider attribution (confidence 0.85)
- US geolocation (confidence 0.35)
No persistent malicious activity detected.
## Anomalies
Geo Validation Discrepancy: Observed RTT of 108ms contradicts claimed distance of 7,626km (minimum expected RTT: 152.5ms). This suggests either:
- Inaccurate geolocation data
- Routing anomalies through intermediate networks
- Data collection methodology issues
## Recommended Actions
No immediate blocking or firewall rules required. This IP represents legitimate CDN infrastructure. Standard observation and logging practices apply. Monitor for any behavioral changes indicating infrastructure misuse.
---
Status: Legitimate CDN infrastructure with low risk profile. No immediate threat action required.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Cloudflare, Inc. |
| ASN | AS13335 |
| Network Name | CLOUDFLARENET |
| CIDR Block | 162.158.0.0/15 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 31% | 2 | 4 |
| routing | 36% | 3 | 4 |
| services | 19% | 2 | 2 |
| ownership | 34% | 3 | 4 |
| reputation | 28% | 1 | 3 |
| geolocation | 27% | 2 | 3 |
| Overall | 29% | 13 | 20 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-25 21:00:24 UTC |
| Last Seen | 2026-08-12 19:52:12 UTC |
| Profile Built | 2026-08-12 20:07:39 UTC |
| Data Freshness | Live |
| Signal Types | 25 |
| Total Observations | 28 |
Full dossier details are available via our API.