Known public DNS resolver (Cloudflare DNS).
- ASN kind
- cdn
- ASN operator
- Cloudflare
- Public resolver
- Cloudflare DNS
Verdict
LIKELY BENIGNHigh confidence
4Supporting signals
4Independent sources
2Recent observations
5 / 100Threat score
Why the engine decided this
Deterministic engine · activity none- KNOWN_PUBLIC_DNS Indicator is a well-known public recursive DNS resolver.
- OTX_KNOWN_FALSE_POSITIVE AlienVault OTX marks the indicator as a known false positive or whitelisted.
- ABUSEIPDB_ALLOWLIST AbuseIPDB lists the IP on its allowlist.
- Cloudflare DNS public DNS resolver: abuse reports usually describe traffic relayed through the service.
Key indicators
- IP address
- 1.1.1.1
- ASN
- AS13335
- Holder
- CLOUDFLARENET - Cloudflare, Inc.
- Country
- Australia (AU)
- Network
- APNIC-LABS
- Prefix
- 1.1.1.0/24
- ISP
- APNIC and Cloudflare DNS Resolver project
- Usage
- Content Delivery Network
- Open ports
- 53, 80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 8080, 8443, 8880
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-23 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| IOCSCAPE knowledge base | Known public DNS resolver (Cloudflare DNS). | — | — | Benign |
 AbuseIPDB | Allowlisted with 0% confidence despite 58 reports; report volume here is noise. | 0% | 0 days recent | Benign |
 AlienVault OTX | Marked as a known false positive or whitelisted. | — | — | Benign |
 VirusTotal | No vendor flags it (0 of 89). | 0/89 | 0 days recent | Benign |
 RDAP | Network APNIC-LABS (1.1.1.0 - 1.1.1.255), AU; APNICRANDNET Infrastructure Contact, IRT-APNICRANDNET-AU, APNIC Research and Development. | — | — | Context |
 RIPEstat | Announced in 1.1.1.0/24 by AS13335 (CLOUDFLARENET - Cloudflare, Inc.). | — | — | Context |
 Shodan | Open ports 53, 80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 8080, 8443, 8880. | — | — | Context |
Coverage · checked, no record: ThreatFox, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list · failed: GreyNoise
Analyst summary
Consistent with engineLikely benign: Cloudflare DNS is a public resolver. Allowlisted with 0% confidence despite 58 reports; report volume here is noise.
Why the evidence points to likely benign
- [AbuseIPDB] Allowlisted with 0% confidence despite 58 reports; report volume here is noise.
- [IOCSCAPE knowledge base] Known public DNS resolver (Cloudflare DNS).
- [AlienVault OTX] Marked as a known false positive or whitelisted.
- [VirusTotal] No vendor flags it (0 of 89).
Lookups failed for GreyNoise: no information either way.
Attribution
Operated by Cloudflare DNS; reports describe traffic relayed through the service, not the operator's own activity.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyNo group is directly linked to this indicator by any source.
All evidence
13 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| IOCSCAPE knowledge base | Known public DNS resolver (Cloudflare DNS). | — | — | Benign |
| AbuseIPDB | Allowlisted with 0% confidence despite 58 reports; report volume here is noise. | 0% | 0 days recent | Benign |
| AlienVault OTX | Marked as a known false positive or whitelisted. | — | — | Benign |
| VirusTotal | No vendor flags it (0 of 89). | 0/89 | 0 days recent | Benign |
| RDAP | Network APNIC-LABS (1.1.1.0 - 1.1.1.255), AU; APNICRANDNET Infrastructure Contact, IRT-APNICRANDNET-AU, APNIC Research and Development. | — | — | Context |
| RIPEstat | Announced in 1.1.1.0/24 by AS13335 (CLOUDFLARENET - Cloudflare, Inc.). | — | — | Context |
| Shodan | Open ports 53, 80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 8080, 8443, 8880. | — | — | Context |
 GreyNoise | Lookup failed: no information either way. | — | — | Failed |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- KNOWN_PUBLIC_DNSIndicator is a well-known public recursive DNS resolver.
- OTX_KNOWN_FALSE_POSITIVEAlienVault OTX marks the indicator as a known false positive or whitelisted.
- ABUSEIPDB_ALLOWLISTAbuseIPDB lists the IP on its allowlist.
- ABUSEIPDB_ZERO_CONFIDENCEAbuseIPDB reports exist but the abuse confidence score is 0%.
Engine notes
- Cloudflare DNS public DNS resolver: abuse reports usually describe traffic relayed through the service.
Analyst summary
Consistent with engineLikely benign: Cloudflare DNS is a public resolver. Allowlisted with 0% confidence despite 58 reports; report volume here is noise.
Why the evidence points to likely benign
- [AbuseIPDB] Allowlisted with 0% confidence despite 58 reports; report volume here is noise.
- [IOCSCAPE knowledge base] Known public DNS resolver (Cloudflare DNS).
- [AlienVault OTX] Marked as a known false positive or whitelisted.
- [VirusTotal] No vendor flags it (0 of 89).
Lookups failed for GreyNoise: no information either way.
Attribution
Operated by Cloudflare DNS; reports describe traffic relayed through the service, not the operator's own activity.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 1.1.1.1
- ASN
- AS13335
- Holder
- CLOUDFLARENET - Cloudflare, Inc.
- Country
- Australia (AU)
- Network
- APNIC-LABS
- Prefix
- 1.1.1.0/24
- ISP
- APNIC and Cloudflare DNS Resolver project
- Usage
- Content Delivery Network
- Open ports
- 53, 80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 8080, 8443, 8880
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-23 (0 days before)
By source
RDAPNetwork APNIC-LABS (1.1.1.0 - 1.1.1.255), AU; APNICRANDNET Infrastructure Contact, IRT-APNICRANDNET-AU, APNIC Research and Development.
- Org
- APNICRANDNET Infrastructure Contact, IRT-APNICRANDNET-AU, APNIC Research and Development
- Range
- 1.1.1.0 - 1.1.1.255
- Country
- AU
- Network
- APNIC-LABS
RIPEstatAnnounced in 1.1.1.0/24 by AS13335 (CLOUDFLARENET - Cloudflare, Inc.).
- ASN
- 13335
- Holder
- CLOUDFLARENET - Cloudflare, Inc.
- Prefix
- 1.1.1.0/24
ShodanOpen ports 53, 80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 8080, 8443, 8880.
- Ports
- 53, 80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 8080, 8443, 8880
- Vulns
- 0
- Hostnames
- guest.wesleycollege.net, one.one.one.one, wifilogin.hydro.mb.ca
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
KNOWN_PUBLIC_DNS Indicator is a well-known public recursive DNS resolver.
Attribution
Operated by Cloudflare DNS; reports describe traffic relayed through the service, not the operator's own activity.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-09-23AbuseIPDB: Allowlisted with 0% confidence despite 58 reports
- 2026-09-23VirusTotal: No vendor flags it (0 of 89)
- 2026-09-23Investigated
Run history
2 collections of this indicator- 2026-09-26LIKELY BENIGN5Stored evidenceShown
- 2026-09-23LIKELY BENIGN5Live lookupsOpen
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- contextInvestigate the internal host and the domains it queried, not the resolver.
- huntReview the specific traffic that triggered the alert.
Pivot to other tools
Opens the indicator in the source's own site (new tab).