# 104.28.152.128 — IP Intelligence Summary 104.28.152.128 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to East Los Angeles, United States. It belongs to datacenter or hosting infrastructure. As of October 9, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/104.28.152.128 - Last updated: 2026-10-09 ## Ownership - Organization: Cloudflare, Inc. - Network name: CLOUDFLARENET - Allocated block: 104.16.0.0/12 - ASN: AS13335 (https://ipdebrief.com/asn/13335) - Regional registry: ARIN ## Location - City: East Los Angeles - Region: California - Country: United States - Time zone: — ## Network classification - Infrastructure type: CDN - Datacenter / hosting: yes - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Moderate Risk (40/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IPDEBRIEF THREAT INTELLIGENCE BRIEFING **IP Address:** 104.28.152.128/32 **Date:** 2026-07-28 **Classification:** Moderate Risk (Score: 40) \--- \## EXECUTIVE SUMMARY IP 104.28.152.128 is a Cloudflare edge infrastructure IP assigned to the CLOUDFLARENET network (ASN 13335). The address exhibits moderate risk characteristics with a reputation score of 40. The IP is part of Cloudflare's CDN network and is currently firewalled with no active services exposed. While the individual IP shows minimal immediate threat indicators, the associated /24 subnet demonstrates elevated neighborhood abuse density requiring contextual monitoring. \--- \## OWNERSHIP & INFRASTRUCTURE PROFILE \- **Organization:** Cloudflare, Inc. \- **ASN:** 13335 (CLOUDFLARENET) \- **CIDR Block:** 104.16.0.0/12 \- **Geolocation:** United States, California, East Los Angeles \- **Network Classification:** CDN/Edge Infrastructure \- **Service Status:** Firewalled / No Services Detected \--- \## THREAT INDICATORS \- **Risk Score:** 40 (Moderate Risk) \- **Abuse Confidence:** Not elevated \- **Known Attacker:** No \- **Spam Source:** No \- **Tor Exit Node:** No \- **Blacklist Count:** 0 \- **DNSBL Listings:** 2 out of 8 threat feeds \- **Persistent Threat Activity:** None detected \--- \## NEIGHBORHOOD CONTEXT (104.28.152.0/24) The /24 subnet shows mixed risk characteristics typical of large CDN deployments: \- **Subnet Abuse Density:** 0.1364 \- **Classification:** Mostly Clean \- **Total Siblings:** 44 IPs \- **Active Siblings:** 32 \- **Threat Siblings:** 6 **Notable High-Risk Neighbors:** | IP Address | Risk Score | Authority Score | |------------|------------|-----------------| | 104.28.152.239 | 80 | 85 | | 104.28.152.244 | 80 | 85 | | 104.28.152.245 | 80 | 85 | | 104.28.152.100 | 70 | 85 | | 104.28.152.129 | 65 | 85 | \--- \## OBSERVATION HISTORY Analysis of 15 historical observations reveals: \- **Latest Observation:** 2026-07-28T10:23:13Z \- **Threat Persistence:** 0 days \- **Ownership Changes:** 0 \- **Signal Types:** Ownership verification, geolocation, subnet analysis, port scans \- **Trend:** No escalation in risk profile over observation period \--- \## NETWORK RELATIONSHIPS \- **Primary Association:** CLOUDFLARENET (Same Network) \- **Relationship Count:** 2 \- **Relationship Type:** Network infrastructure mapping \--- \## RECOMMENDED ACTIONS **Threat Level:** LOW-MODERATE (Infrastructure IP with contextual risk) **Recommended Firewall Rules:** \- **iptables:** \`iptables -A INPUT -s 104.28.152.128 -j DROP\` \- **nftables:** \`nft add rule inet filter input ip saddr 104.28.152.128 drop\` \- **nginx:** \`deny 104.28.152.128;\` \- **Cloudflare WAF:** Block expression: \`ip.src eq 104.28.152.128\` \- **AWS WAF:** Add address \`104.28.152.128/32\` with description "IPDebrief risk 40" **Operational Notes:** \- This is a Cloudflare CDN edge IP; blocking may impact legitimate traffic if the IP is being used for proxying \- The subnet contains 6 confirmed threat siblings; consider monitoring adjacent IPs if threat activity is observed \- No active services detected on this specific IP; threat indicators are primarily contextual \--- \## ANALYST NOTES While the individual IP 104.28.152.128 shows no direct malicious activity, SOC teams should monitor the broader 104.28.152.0/24 subnet for coordinated threat activity. The presence of multiple high-risk neighbors (scores 65-80) suggests this subnet may be hosting compromised edge infrastructure or being used for proxy-based attacks. **Recommendation:** Monitor for anomalous traffic patterns from this IP and adjacent high-risk neighbors. If threat activity is confirmed, consider blocking the specific IP while maintaining awareness of subnet-level context. ## Nearby addresses - 104.28.152.11 (https://ipdebrief.com/104.28.152.11) - 104.28.152.34 (https://ipdebrief.com/104.28.152.34) - 104.28.152.36 (https://ipdebrief.com/104.28.152.36) - 104.28.152.38 (https://ipdebrief.com/104.28.152.38) - 104.28.152.39 (https://ipdebrief.com/104.28.152.39) - 104.28.152.40 (https://ipdebrief.com/104.28.152.40) - 104.28.152.89 (https://ipdebrief.com/104.28.152.89) - 104.28.152.90 (https://ipdebrief.com/104.28.152.90) - 104.28.152.99 (https://ipdebrief.com/104.28.152.99) - 104.28.152.100 (https://ipdebrief.com/104.28.152.100) - 104.28.152.115 (https://ipdebrief.com/104.28.152.115) - 104.28.152.116 (https://ipdebrief.com/104.28.152.116) --- Source: IPDebrief, "104.28.152.128 IP intelligence", https://ipdebrief.com/104.28.152.128, updated 2026-10-09. Assessments are probabilistic.