AS13335

AS13335 is Cloudflare's global autonomous system, registered to Cloudflare, Inc. under ARIN and active since July 2010. It powers an anycast content-delivery, DDoS-mitigation, and WAF platform, plus the 1.1.1.1 public resolver. Per Cloudflare's April 2026 "500 Tbps of capacity" post, the company runs a 500 Tbps network across 330+ cities in 125+ countries with 13,000+ peering networks and partners, and states it sits in front of more than 20% of the web. A distinctive feature is that AS13335 announces more IPv6 prefixes than IPv4 — typical of a modern anycast CDN — and signs/registers its prefixes for RPKI. The IRR set AS13335:AS-CLOUDFLARE enrolls sibling/BYOIP ASNs including AS132892, AS133877, AS202623, AS209242, AS394536, AS400095, alongside AS13335:AS-CUSTOMERS. The decisive analyst caveat: an address here is almost always a Cloudflare edge proxy, not the origin server, and the same anycast IPs front both legitimate and malicious hostnames. You cannot judge hosted content from the IP — the origin must be unmasked by other means.

Operator

Cloudflare, Inc. (ARIN OrgId CLOUD14) [Confirmed] — ARIN RDAP/WHOIS

Country / RIR

US, ARIN [Confirmed] — ARIN RDAP

Allocated

2010-07-14 (org RegDate 2010-07-09) [Confirmed] — ARIN RDAP

Org status

active — cloudflare.com

Security/abuse context

proxied sites present Cloudflare IPs and hide the origin (shared anycast across all proxied hostnames); Spamhaus ("Too big to care?") reported ~10.05% of DBL-listed domains on Cloudflare nameservers plus 1,201 unresolved SBL listings, criticizing a content-neutral abuse posture; Fortra/SC Media (2024) reported phishing abuse of pages.dev/workers.dev more than doubled 2023→2024; Proofpoint/THN (2024) documented TryCloudflare tunnels abused for C2 — spamhaus.org, scworld.com, thehackernews.com

Network & routing

Network type

CDN (anycast edge / reverse proxy / security) [Confirmed] — operator docs + bgp.tools

Size

~2,449–2,701 IPv4 prefixes (~1.38M addrs), ~3,206–3,349 IPv6 (IPv6 > IPv4); ~3,809 peers; ~359 IXPs — bgp.tools / bgp.he.net (2026-05)

Routing/peering

open (PeeringDB-driven; automatic IX peering via portal; PNI at 10 Gbps; embedded-cache program); RPKI valid (all prefixes signed) — cloudflare.com/peering-policy

Notable usage

global anycast CDN, DDoS mitigation, WAF, 1.1.1.1 resolver; "500 Tbps... 330+ cities... 125+ countries," protects ">20% of the web" — blog.cloudflare.com/500-tbps-of-capacity

Related ASNs

AS132892, AS133877, AS202623, AS209242, AS394536, AS400095 (AS13335:AS-CLOUDFLARE)

Analyst note

An IP here is a Cloudflare EDGE node, not the origin. Do not attribute hosted content's reputation to the IP — legitimate and malicious sites share these anycast addresses; unmask the origin separately.