104.28.156.248📋 Copy

# IP Intelligence Briefing: 104.28.156.248/32

Classification: Low-Risk CDN Infrastructure

Date: 2026-07-24

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP address 104.28.156.248 operates as Cloudflare CDN infrastructure with a low-risk reputation profile. The address belongs to Cloudflare, Inc. (AS13335) within the CLOUDFLARENET CIDR block. Risk assessment indicates minimal threat activity with a current risk score of 15. No active malicious campaigns or attacker indicators were detected.

---

## Infrastructure Profile

---

## Threat Indicators Assessment

Active Threat Indicators: None detected

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Association: None
• Blacklist Count: 0

Behavioral Analysis:

• Open Ports: None detected
• TLS Certificates: None detected
• Service Banners: None detected
• HTTP Title: None detected

Control Plane:

• BGP Prefix: 104.28.156.0/24
• Route Stability: False
• DNSSEC Validated: Yes
• Operator Score: 0.1304 (Minimal)

---

## Neighborhood Analysis (104.28.156.0/24)

High-Risk Neighbors Identified:

• 104.28.156.34 (Risk: 25, Authority: 85)
• 104.28.156.41 (Risk: 25, Authority: 85)
• 104.28.156.53 (Risk: 40, Authority: 85)
• 104.28.156.63 (Risk: 30, Authority: 85)

The subnet maintains a clean profile with minimal abuse density, consistent with typical CDN infrastructure characteristics.

---

## Historical Signal Observations

Observation Count: 14 signals recorded

Key Historical Signals:

• CDN classification confirmed across multiple observations
• Geolocation consistency: US region with varying city reports
• Ownership stability: No changes detected
• Threat persistence: None observed
• Infrastructure type: CDN (confirmed)

Recent observations indicate stable operational characteristics with no degradation in risk profile over the observation period.

---

## Relationship Graph

Identified Relationships: 3

• Same Network: CLOUDFLARENET (Cloudflare infrastructure)

All relationships point to Cloudflare's network infrastructure, confirming this address operates within the Cloudflare CDN ecosystem.

---

## Recommended Security Actions

Classification: Low Risk - No Immediate Action Required

Recommended Actions:

1. Monitoring: Standard CDN traffic monitoring applies

2. Firewall Rules: No blocking recommended

3. WAF Rules: No specific rules required

4. Incident Response: No action required unless abuse is observed from this address

Rationale: This IP represents legitimate Cloudflare CDN infrastructure with low-risk characteristics. Standard CDN egress traffic should be permitted. No evidence of malicious activity or abuse patterns detected.

---

## Conclusion

IP 104.28.156.248 operates as legitimate Cloudflare CDN infrastructure with a low-risk profile. The address shows no active threat indicators and maintains stability within the Cloudflare network. The surrounding subnet (104.28.156.0/24) demonstrates minimal abuse density with 4 threat siblings out of 54 total addresses. SOC teams should classify this as routine CDN infrastructure requiring standard monitoring practices. No immediate blocking or remediation actions are warranted.

Status: Cleared for normal operation

Review Cycle: Standard (monthly recommended)

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.