# 104.28.157.105 — IP Intelligence Summary 104.28.157.105 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to San Jose, United States. It belongs to datacenter or hosting infrastructure. As of October 7, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/104.28.157.105 - Last updated: 2026-10-07 ## Ownership - Organization: Cloudflare, Inc. - Network name: CLOUDFLARENET - Allocated block: 104.16.0.0/12 - ASN: AS13335 (https://ipdebrief.com/asn/13335) - Regional registry: ARIN ## Location - City: San Jose - Region: California - Country: United States - Time zone: — ## Network classification - Infrastructure type: CDN - Datacenter / hosting: yes - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \## IP Intelligence Briefing: 104.28.157.105/32 **Classification:** Low Risk Infrastructure **Date:** July 23, 2026 **Analyst:** IPDebrief Intelligence Team \--- \### Executive Summary IP address 104.28.157.105 belongs to Cloudflare, Inc. (ASN 13335, CLOUDFLARENET) and presents a low-risk threat profile with a risk score of 25. The IP is classified as firewalled with no active services detected. No known malicious activity or threat indicators were identified during analysis. \--- \### Ownership and Network Classification \- **Organization:** Cloudflare, Inc. \- **ASN:** 13335 \- **CIDR Block:** 104.16.0.0/12 \- **Abuse Contact:** Available via RDAP \- **Geolocation:** San Jose, CA, US (Americas/Los_Angeles timezone) \- **Network Role:** Firewalled / No Services \- **Infrastructure Type:** Not identified as CDN, cloud provider, VPN, proxy, Tor, hosting, mobile, or residential infrastructure \--- \### Threat Assessment \- **Overall Risk Score:** 25 (Low Risk) \- **Abuse Confidence Score:** Not available \- **Blacklist Status:** Clean (0 blacklists) \- **DNSBL Status:** Listed on 1 of 8 threat intelligence feeds \- **Threat Indicators:** None detected \- **Tor Exit Node:** No \- **Known Attacker:** No \- **Spam Source:** No \- **Campaign Correlation:** No known campaign associations \--- \### Network Neighborhood Analysis Subnet 104.28.157.0/24 contains 41 sibling IPs with an abuse density of 0.024 (low). Risk distribution within the subnet: \- **High Risk:** 1 IP (104.28.157.117, score 80) \- **Medium Risk:** 8 IPs \- **Low Risk:** 8 IPs \- **Clean:** Multiple IPs with scores of 0-25 Notable high-risk neighbors include 104.28.157.117 (80), 104.28.157.118 (65), and 104.28.157.108 (40), indicating the presence of some malicious activity within the broader Cloudflare block. \--- \### Services and Port Analysis \- **Open Ports:** None detected \- **TLS Certificate:** Not detected \- **HTTP Title:** Not detected \- **Server Banner:** Not detected The IP shows no active services, consistent with Cloudflare's infrastructure design where edge nodes handle traffic without exposing backend services. \--- \### DNS Configuration \- **PTR Hostnames:** None resolved \- **Forward Resolution:** Not confirmed \- **Hosted Domains:** None \- **Email Authentication:** SPF, DMARC, and TXT records not configured \- **DNSSEC:** Valid \--- \### Historical Observations Analysis of 12 historical observations reveals: \- Most recent signals dated July 23, 2026 \- Geolocation inconsistencies observed across different data sources (coordinates ranging from CA 36.78°N to 39.83°N) \- DNSBL listings appeared in threat observations \- Signal confidence ranged from 0.30 to 0.95 \- No evidence of persistent malicious behavior \--- \### Security Recommendations **Recommended Actions:** \- No immediate blocking required based on current risk profile \- Monitor for service activation if previously firewalled \- Consider context-dependent filtering based on source reputation \- No specific firewall rules generated due to low risk classification **Monitoring Priorities:** \- Track DNSBL listing status changes \- Monitor for service port openings \- Watch for any correlation with known threat campaigns \- Continue observing subnet-level activity for emerging threats \--- \### Intelligence Narrative The target IP 104.28.157.105 represents legitimate Cloudflare infrastructure. The absence of open ports and services is expected behavior for CDN edge nodes. While the IP has minimal threat indicators, analysts should note the presence of higher-risk neighbors within the same /24 subnet, particularly 104.28.157.117 (risk score 80). The single DNSBL listing warrants periodic verification but does not indicate current malicious activity. No immediate defensive actions are required, though SOC teams should maintain awareness of subnet-level threat activity and adjust monitoring rules as needed based on evolving threat intelligence. \--- **Status:** Clear for monitoring **Next Review:** As threat landscape evolves **Confidence Level:** High ## Nearby addresses - 104.28.157.1 (https://ipdebrief.com/104.28.157.1) - 104.28.157.2 (https://ipdebrief.com/104.28.157.2) - 104.28.157.3 (https://ipdebrief.com/104.28.157.3) - 104.28.157.4 (https://ipdebrief.com/104.28.157.4) - 104.28.157.13 (https://ipdebrief.com/104.28.157.13) - 104.28.157.14 (https://ipdebrief.com/104.28.157.14) - 104.28.157.15 (https://ipdebrief.com/104.28.157.15) - 104.28.157.20 (https://ipdebrief.com/104.28.157.20) - 104.28.157.21 (https://ipdebrief.com/104.28.157.21) - 104.28.157.22 (https://ipdebrief.com/104.28.157.22) - 104.28.157.23 (https://ipdebrief.com/104.28.157.23) - 104.28.157.24 (https://ipdebrief.com/104.28.157.24) --- Source: IPDebrief, "104.28.157.105 IP intelligence", https://ipdebrief.com/104.28.157.105, updated 2026-10-07. Assessments are probabilistic.