Autonomous system
AS13335 CLOUDFLARENET
Hosting ARIN Content
Summary
Cloudflare, Inc.
cdn dns security ddos-protection
Cloudflare runs one of the world's largest edge networks, sitting in front of a huge slice of the web as a CDN, reverse proxy, and DDoS-mitigation layer.
What it's used for
- Caching and accelerating websites from data centers in hundreds of cities.
- Absorbing and filtering DDoS attacks and malicious traffic before it reaches an origin server.
- Public DNS resolver
1.1.1.1, WARP/Zero Trust, R2 storage, and the Workers edge-compute platform.
Notable
1.1.1.0/24(the1.1.1.1resolver) is one of the most recognizable prefixes on the internet and a common test target.- Because so many sites hide behind Cloudflare, an IP in this ASN usually tells you the proxy, not the site's real origin or its true location.
Interesting
- Cloudflare famously points a wall of lava lamps ("LavaRand") at cameras to help seed cryptographic randomness.
This description is AI-generated, best-effort context — not authoritative, and provided without any guarantee of accuracy. Source, and how to suggest an edit.
Interconnection
Peering at a glance
Internet exchanges
Recorded at 251 exchanges in 70 countries, largest first.
| Exchange | Location | Their address |
|---|---|---|
| IX.br (PTT.br) São Paulo | São Paulo, Brazil | 187.16.219.111 |
| DE-CIX Frankfurt | Frankfurt, Germany | 80.81.194.180 |
| Indonesian Internet Exchange (IIX-Jakarta) | Jakarta, Indonesia | 123.108.9.176 |
| IX.br (PTT.br) Fortaleza | Fortaleza, Brazil | 45.68.72.137 |
| LINX LON1 | London, United Kingdom | 195.66.227.207 |
| AMS-IX Amsterdam | Amsterdam, Netherlands | 80.249.211.140 |
| Jakarta Internet Exchange | Jakarta, Indonesia | 119.11.184.14 |
| Neutral Internet Exchange | Amsterdam, Netherlands | 193.239.117.14 |
Transit providers
228 upstream, 1,027 downstream and 1,242 adjacent networks observed; most-used upstreams first.
| AS | Network | Paths seen |
|---|---|---|
| AS3356 | Level 3 Parent, LLC | 27,249 |
| AS1299 | Arelion Sweden AB | 25,018 |
| AS174 | Cogent Communications, LLC | 21,335 |
| AS2914 | NTT America, Inc. | 12,952 |
| AS3257 | GTT Communications Inc. | 10,201 |
| AS6453 | TATA COMMUNICATIONS (AMERICA) INC | 10,015 |
| AS34549 | meerfarbig GmbH & Co. KG | 9,053 |
| AS6762 | TELECOM ITALIA SPARKLE S.p.A. | 7,475 |
Exchange presence is recorded rather than inferred: the directory collected by Packet Clearing House (https://www.pch.net/ixp/data) on 2026-10-10, licensed CC BY-NC-SA 3.0. Transit is inferred from observed BGP paths, never declared by either party.
Address space
Summary
IPv4 1,127 prefixes · 1.45M addresses IPv6 1,851 prefixes
| Country | Name | Prefixes |
|---|---|---|
| US | United States of America | 2,978 |
Registry
Allocation record
- Registry
- ARIN
- Handle
AS13335- Registry name
- CLOUDFLARENET
- Registrant
- Cloudflare, Inc.
- Abuse contact
- abuse@cloudflare.com
- Registered
- 2010-07-14
- Last changed
- 2017-02-17
- Allocation
- assigned
Declared
PeeringDB profile
- Name
- Cloudflare
- Network type
- Content
- Scope
- Global
- Traffic ratio
- Mostly Outbound
- Peering policy
- Open
- IRR as-set
AS13335:AS-CLOUDFLARE- Present at
- 356 exchanges
- Facilities
- 224 facilities
- Website
- https://www.cloudflare.com
PeeringDB records are maintained by the network operator and are not independently verified. Treat them as a statement of intent rather than of fact. For the observed and recorded view, see peering, which lists the exchanges Packet Clearing House has a port on file for.
Routing security
RPKI and IRR
- RPKI
- 95% valid · 5,434 valid, 278 with no ROA 6 RPKI-invalid
- ROAs
- 5,398 authorising AS13335
- ASPA
- no ASPA record
- IRR
- 99.8% registered · 5,706 of 5,718 announcements 6 other origin
- Route objects
- 56,662 naming AS13335
Reputation
Classification and threat
Hosting Datacenter or cloud provider. Addresses are servers, not people.
Spamhaus DROP
Not on ASN-DROP The network as a whole is not listed.
No DROP prefixes None of its announced space is on the DROP prefix list.
Spamhaus DROP ("Don't Route Or Peer") lists space and networks run by, or hijacked for, spam and cybercrime operations: 431 networks and 1,775 prefixes, as published 2026-10-11. A short, high-confidence list, so a match is worth taking seriously, and absence from it says little on its own.
FBI IC3
3 IC3 indicators addresses in this network appear in FBI IC3 cybersecurity advisories.
| Prefix | Advisory | Published |
|---|---|---|
104.28.155.27 | FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts | 2026-10-06 |
45.199.188.1 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
45.199.188.251 | China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems | 2026-08-26 |
IC3 threat data is alpha. Absence of an indicator is not evidence of good behaviour, only of absence from this one feed.
Elsewhere