Network Report

AS13335 — Cloudflare, Inc.

What Predax has observed across this network's address space, and what it means for traffic screening.

Addresses observed
4,488
100% carried a flag

About this network

Cloudflare, Inc. (AS13335) operates content-delivery and edge infrastructure — the servers that sit in front of websites and deliver their pages, not the machines people browse from. 100% of the 4,488 addresses we have observed on it carry the datacenter flag, and that is a statement about routing, not a warning: this is what a CDN's address space is supposed to look like.

The number that matters here is different: only 26 of 4,488 observed addresses (1%) carried a notable risk score when last checked. Predax deliberately exempts recognised infrastructure operators from the datacenter risk weight — scoring a CDN's addresses as threats would push site owners into blocking the network that serves their own content.

Observed
4,488
distinct addresses checked
Flagged
100%
4,486 with any threat flag
Notable risk
1%
26 scoring 40+
Countries
69
where addresses geolocate

Flag composition

Share of observed addresses carrying each classification when last checked.

VPN30%
Proxy00%
Tor00%
Datacenter4,486100%

Geography

United States
1,659
United Kingdom
1,299
Singapore
274
Netherlands
238
Canada
156
Germany
154
Most-seen cities

London (GB) · Ashburn (US) · Chicago (US) · Singapore (SG) · Amsterdam (NL) · Dallas (US)

Observation window

Addresses on this network have been looked up through Predax between January 10, 2026 and August 31, 2026. Each figure on this page reflects an address's most recent check, not a permanent record.

Geographically, the observed addresses span 69 countries, with the largest share (1,659 of 4,488) geolocating to United States.

A footprint that wide usually means globally distributed infrastructure — the same operator announcing address space from many regions — rather than a network serving one local population.

Should you screen traffic from this network?

Do not block this network. Its addresses are the delivery path for ordinary websites — including, very possibly, your own. A request from here is usually a CDN edge fetching or serving content, not a visitor to screen.

If an address from this network is misbehaving in your logs, judge the behaviour — the request pattern, the endpoints it touches — rather than the network. Its individual report page will show whether anything beyond the infrastructure flags was detected.

Addresses observed on this network

A sample of the most-looked-up addresses — each links to its full report. Capped at 12.

Check Another IP