104.28.152.128📋 Copy

# IPDEBRIEF THREAT INTELLIGENCE BRIEFING

IP Address: 104.28.152.128/32

Date: 2026-07-28

Classification: Moderate Risk (Score: 40)

---

## EXECUTIVE SUMMARY

IP 104.28.152.128 is a Cloudflare edge infrastructure IP assigned to the CLOUDFLARENET network (ASN 13335). The address exhibits moderate risk characteristics with a reputation score of 40. The IP is part of Cloudflare's CDN network and is currently firewalled with no active services exposed. While the individual IP shows minimal immediate threat indicators, the associated /24 subnet demonstrates elevated neighborhood abuse density requiring contextual monitoring.

---

## OWNERSHIP & INFRASTRUCTURE PROFILE

• Organization: Cloudflare, Inc.
• ASN: 13335 (CLOUDFLARENET)
• CIDR Block: 104.16.0.0/12
• Geolocation: United States, California, East Los Angeles
• Network Classification: CDN/Edge Infrastructure
• Service Status: Firewalled / No Services Detected

---

## THREAT INDICATORS

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence: Not elevated
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• DNSBL Listings: 2 out of 8 threat feeds
• Persistent Threat Activity: None detected

---

## NEIGHBORHOOD CONTEXT (104.28.152.0/24)

The /24 subnet shows mixed risk characteristics typical of large CDN deployments:

• Subnet Abuse Density: 0.1364
• Classification: Mostly Clean
• Total Siblings: 44 IPs
• Active Siblings: 32
• Threat Siblings: 6

Notable High-Risk Neighbors:

---

## OBSERVATION HISTORY

Analysis of 15 historical observations reveals:

• Latest Observation: 2026-07-28T10:23:13Z
• Threat Persistence: 0 days
• Ownership Changes: 0
• Signal Types: Ownership verification, geolocation, subnet analysis, port scans
• Trend: No escalation in risk profile over observation period

---

## NETWORK RELATIONSHIPS

• Primary Association: CLOUDFLARENET (Same Network)
• Relationship Count: 2
• Relationship Type: Network infrastructure mapping

---

## RECOMMENDED ACTIONS

Threat Level: LOW-MODERATE (Infrastructure IP with contextual risk)

Recommended Firewall Rules:

• iptables: `iptables -A INPUT -s 104.28.152.128 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 104.28.152.128 drop`
• nginx: `deny 104.28.152.128;`
• Cloudflare WAF: Block expression: `ip.src eq 104.28.152.128`
• AWS WAF: Add address `104.28.152.128/32` with description "IPDebrief risk 40"

Operational Notes:

• This is a Cloudflare CDN edge IP; blocking may impact legitimate traffic if the IP is being used for proxying
• The subnet contains 6 confirmed threat siblings; consider monitoring adjacent IPs if threat activity is observed
• No active services detected on this specific IP; threat indicators are primarily contextual

---

## ANALYST NOTES

While the individual IP 104.28.152.128 shows no direct malicious activity, SOC teams should monitor the broader 104.28.152.0/24 subnet for coordinated threat activity. The presence of multiple high-risk neighbors (scores 65-80) suggests this subnet may be hosting compromised edge infrastructure or being used for proxy-based attacks.

Recommendation: Monitor for anomalous traffic patterns from this IP and adjacent high-risk neighbors. If threat activity is confirmed, consider blocking the specific IP while maintaining awareness of subnet-level context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.