104.28.157.105📋 Copy

## IP Intelligence Briefing: 104.28.157.105/32

Classification: Low Risk Infrastructure

Date: July 23, 2026

Analyst: IPDebrief Intelligence Team

---

Executive Summary

IP address 104.28.157.105 belongs to Cloudflare, Inc. (ASN 13335, CLOUDFLARENET) and presents a low-risk threat profile with a risk score of 25. The IP is classified as firewalled with no active services detected. No known malicious activity or threat indicators were identified during analysis.

---

Ownership and Network Classification

• Organization: Cloudflare, Inc.
• ASN: 13335
• CIDR Block: 104.16.0.0/12
• Abuse Contact: Available via RDAP
• Geolocation: San Jose, CA, US (Americas/Los_Angeles timezone)
• Network Role: Firewalled / No Services
• Infrastructure Type: Not identified as CDN, cloud provider, VPN, proxy, Tor, hosting, mobile, or residential infrastructure

---

Threat Assessment

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not available
• Blacklist Status: Clean (0 blacklists)
• DNSBL Status: Listed on 1 of 8 threat intelligence feeds
• Threat Indicators: None detected
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Campaign Correlation: No known campaign associations

---

Network Neighborhood Analysis

Subnet 104.28.157.0/24 contains 41 sibling IPs with an abuse density of 0.024 (low). Risk distribution within the subnet:

• High Risk: 1 IP (104.28.157.117, score 80)
• Medium Risk: 8 IPs
• Low Risk: 8 IPs
• Clean: Multiple IPs with scores of 0-25

Notable high-risk neighbors include 104.28.157.117 (80), 104.28.157.118 (65), and 104.28.157.108 (40), indicating the presence of some malicious activity within the broader Cloudflare block.

---

Services and Port Analysis

• Open Ports: None detected
• TLS Certificate: Not detected
• HTTP Title: Not detected
• Server Banner: Not detected

The IP shows no active services, consistent with Cloudflare's infrastructure design where edge nodes handle traffic without exposing backend services.

---

DNS Configuration

• PTR Hostnames: None resolved
• Forward Resolution: Not confirmed
• Hosted Domains: None
• Email Authentication: SPF, DMARC, and TXT records not configured
• DNSSEC: Valid

---

Historical Observations

Analysis of 12 historical observations reveals:

• Most recent signals dated July 23, 2026
• Geolocation inconsistencies observed across different data sources (coordinates ranging from CA 36.78°N to 39.83°N)
• DNSBL listings appeared in threat observations
• Signal confidence ranged from 0.30 to 0.95
• No evidence of persistent malicious behavior

---

Security Recommendations

Recommended Actions:

• No immediate blocking required based on current risk profile
• Monitor for service activation if previously firewalled
• Consider context-dependent filtering based on source reputation
• No specific firewall rules generated due to low risk classification

Monitoring Priorities:

• Track DNSBL listing status changes
• Monitor for service port openings
• Watch for any correlation with known threat campaigns
• Continue observing subnet-level activity for emerging threats

---

Intelligence Narrative

The target IP 104.28.157.105 represents legitimate Cloudflare infrastructure. The absence of open ports and services is expected behavior for CDN edge nodes. While the IP has minimal threat indicators, analysts should note the presence of higher-risk neighbors within the same /24 subnet, particularly 104.28.157.117 (risk score 80). The single DNSBL listing warrants periodic verification but does not indicate current malicious activity. No immediate defensive actions are required, though SOC teams should maintain awareness of subnet-level threat activity and adjust monitoring rules as needed based on evolving threat intelligence.

---

Status: Clear for monitoring

Next Review: As threat landscape evolves

Confidence Level: High

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.