# 104.28.157.108 — IP Intelligence Summary

104.28.157.108 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to San Jose, United States. It belongs to datacenter or hosting infrastructure. As of November 5, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/104.28.157.108
- Last updated: 2026-11-05

## Ownership

- Organization: Cloudflare, Inc.
- Network name: CLOUDFLARENET
- Allocated block: 104.16.0.0/12
- ASN: AS13335 (https://ipdebrief.com/asn/13335)
- Regional registry: ARIN

## Location

- City: San Jose
- Region: California
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: CDN
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 104.28.157.108/32

\## Executive Summary

IP address 104.28.157.108 is associated with Cloudflare, Inc. infrastructure (104.16.0.0/12, ARIN) and is currently classified as **Low Risk** with a risk score of 0. The IP presents as a firewalled host with no active services. While current threat indicators are absent, historical data reveals 8 blacklist listings with maximum severity ratings of "high," indicating prior malicious activity associated with this address or its operational context.

\## Ownership and Infrastructure

\- **Organization**: Cloudflare, Inc.

\- **ASN**: Not resolved in profile

\- **CIDR Block**: 104.16.0.0/12

\- **Abuse Contact**: abuse@cloudflare.com

\- **RIR**: ARIN

\- **Geolocation**: United States, California (94107)

\- **Network Role**: Firewalled / No Services (isCloud: false, isCdn: false, isProxy: false)

\## Threat Assessment

\### Current Status

\- **Risk Score**: 0 (Low Risk)

\- **Blacklist Status**: 8 total listings, 2 currently active with "high" severity

\- **Tor Exit**: No

\- **Known Attacker**: No

\- **Spam Source**: No

\### Historical Observations (2026-07-23)

The IP has been observed 10 times. Key signals include:

\- **RIR Registration**: ARIN, Cloudflare, Inc.

\- **Network Block**: 104.16.0.0/12 (CLOUDFLARENET)

\- **Blacklist Activity**: 8 listings with maximum severity "high"

\- **DNSSEC Status**: Minimal (raw score: 0.15)

\- **Overall Data Confidence**: Low (0.1667)

\### Behavioral Indicators

\- **Honeypot Hits**: 0

\- **Enumeration Strikes**: 0

\- **WAF Violations**: 0

\- **Total Incidents**: 0

\- **Active Attacker Status**: No

\## Subnet Analysis (104.28.157.0/24)

\- **Total Neighbors**: 41

\- **Abuse Density**: 0.024 (2.4%)

\- **Risk Distribution**: 1 high, 5 medium, 9 low

\### Notable High-Risk Neighbors

| IP Address | Risk Score | Authority Score |

|------------|-----------|-----------------|

| 104.28.157.117 | 80 | 85 |

| 104.28.157.3 | 70 | 85 |

| 104.28.157.118 | 65 | 85 |

| 104.28.157.1 | 55 | 85 |

The subnet demonstrates moderate abuse activity with several neighbors exhibiting elevated risk scores, suggesting potential shared infrastructure or lateral threat vectors.

\## Network Services

\- **Open Ports**: None detected

\- **TLS Certificate**: None

\- **HTTP Title**: None

\- **Server Banner**: None

\- **DNS PTR Records**: None

\- **Forward Resolution**: Confirmed: No

\## Relationships

No direct relationships (subnets, hostnames, organizations, certificates) were identified for this IP address.

\## Security Recommendations

Current risk profile (score: 0) does not warrant immediate defensive action. Standard monitoring practices are sufficient. Given historical blacklist activity and subnet abuse density, maintain awareness of:

\- Blacklist listing updates

\- Neighboring IP risk escalations

\- Any service activation on this address

\## Conclusion

IP 104.28.157.108 is a Cloudflare infrastructure address with current low-risk characteristics. Historical blacklist associations and elevated risk scores among subnet neighbors warrant continued monitoring, but no immediate blocking or mitigation actions are indicated by the current threat profile.

## Nearby addresses

- 104.28.157.1 (https://ipdebrief.com/104.28.157.1)
- 104.28.157.2 (https://ipdebrief.com/104.28.157.2)
- 104.28.157.3 (https://ipdebrief.com/104.28.157.3)
- 104.28.157.4 (https://ipdebrief.com/104.28.157.4)
- 104.28.157.13 (https://ipdebrief.com/104.28.157.13)
- 104.28.157.14 (https://ipdebrief.com/104.28.157.14)
- 104.28.157.15 (https://ipdebrief.com/104.28.157.15)
- 104.28.157.20 (https://ipdebrief.com/104.28.157.20)
- 104.28.157.21 (https://ipdebrief.com/104.28.157.21)
- 104.28.157.22 (https://ipdebrief.com/104.28.157.22)
- 104.28.157.23 (https://ipdebrief.com/104.28.157.23)
- 104.28.157.24 (https://ipdebrief.com/104.28.157.24)

---

Source: IPDebrief, "104.28.157.108 IP intelligence", https://ipdebrief.com/104.28.157.108, updated 2026-11-05. Assessments are probabilistic.