# 104.28.157.109 — IP Intelligence Summary

104.28.157.109 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to San Jose, United States. It belongs to datacenter or hosting infrastructure. As of September 1, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/104.28.157.109
- Last updated: 2026-09-01

## Ownership

- Organization: Cloudflare, Inc.
- Network name: CLOUDFLARENET
- Allocated block: 104.16.0.0/12
- ASN: AS13335 (https://ipdebrief.com/asn/13335)
- Regional registry: ARIN

## Location

- City: San Jose
- Region: California
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: CDN
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 104.28.157.109/32

**Classification**: Legitimate CDN Infrastructure | **Risk Level**: Low Risk | **Status**: Operational

\---

\## Executive Summary

IP address 104.28.157.109 is a Cloudflare CDN endpoint operating from the CLOUDFLARENET network. The address demonstrates low-risk characteristics with no active threat indicators, blacklist entries, or malicious activity observed. The IP serves as part of Cloudflare's content delivery and security infrastructure.

\---

\## Network Ownership & Classification

| Attribute | Value |

|-----------|-------|

| **Organization** | Cloudflare, Inc. |

| **AS Number** | 13335 |

| **Network Block** | 104.16.0.0/12 |

| **Infrastructure Type** | CDN (Content Delivery Network) |

| **Geolocation** | San Jose, California, US |

| **Status** | Firewalled / No Services |

The IP is part of a large-scale CDN network with no open ports or active services. The network role is confirmed as cloud-based infrastructure with no proxy, VPN, or residential characteristics.

\---

\## Threat Assessment

**Current Risk Score**: 0 (Low Risk)

\- **Blacklist Count**: 0

\- **Known Campaigns**: None detected

\- **Abuse Confidence Score**: Not applicable

\- **Is Tor Exit**: No

\- **Is Known Attacker**: No

\- **Is Spam Source**: No

No threat indicators or malicious activity have been associated with this IP address.

\---

\## Neighborhood Analysis (104.28.157.0/24)

| Metric | Value |

|--------|-------|

| **Total Siblings** | 43 |

| **Active Siblings** | 18 |

| **Threat Siblings** | 5 |

| **Abuse Density** | 0.024 (2.4%) |

| **Classification** | Mostly Clean |

| **Inherited Risk** | 4 (Low) |

Risk distribution across the subnet:

\- High Risk: 1 IP (104.28.157.117 - risk score 80)

\- Medium Risk: 10 IPs (various risk scores 40-80)

\- Low Risk: 28 IPs (including target IP)

The target IP falls within the low-risk classification of its subnet.

\---

\## Observation History

**Total Observations**: 15 signals tracked

Recent observations confirm stable network behavior with no changes in:

\- Ownership status

\- Threat persistence

\- Risk classification

\- Network classification

The IP has demonstrated consistent operational behavior without escalation of threat indicators.

\---

\## Related Entities

All relationship queries return connections to the CLOUDFLARENET network, confirming the IP's placement within Cloudflare's infrastructure. No external organizational or certificate relationships were identified.

\---

\## Recommended Actions

Based on the low-risk profile and legitimate CDN infrastructure classification:

1. **Allow Traffic**: No blocking recommended for outbound/inbound traffic to/from this IP

2. **Monitor**: Standard monitoring applies; no special surveillance required

3. **Exception Note**: If blocking CDN traffic is part of your security posture, this IP would be included in any general Cloudflare blocking rules

\---

\## Intelligence Conclusion

IP 104.28.157.109 represents legitimate Cloudflare CDN infrastructure. No defensive action or blocking is recommended. This IP should be permitted through network security controls as part of normal web traffic. If the IP appears in blocked traffic logs, investigate the context of the traffic rather than assuming malicious origin.

## Nearby addresses

- 104.28.157.1 (https://ipdebrief.com/104.28.157.1)
- 104.28.157.2 (https://ipdebrief.com/104.28.157.2)
- 104.28.157.3 (https://ipdebrief.com/104.28.157.3)
- 104.28.157.4 (https://ipdebrief.com/104.28.157.4)
- 104.28.157.13 (https://ipdebrief.com/104.28.157.13)
- 104.28.157.14 (https://ipdebrief.com/104.28.157.14)
- 104.28.157.15 (https://ipdebrief.com/104.28.157.15)
- 104.28.157.20 (https://ipdebrief.com/104.28.157.20)
- 104.28.157.21 (https://ipdebrief.com/104.28.157.21)
- 104.28.157.22 (https://ipdebrief.com/104.28.157.22)
- 104.28.157.23 (https://ipdebrief.com/104.28.157.23)
- 104.28.157.24 (https://ipdebrief.com/104.28.157.24)

---

Source: IPDebrief, "104.28.157.109 IP intelligence", https://ipdebrief.com/104.28.157.109, updated 2026-09-01. Assessments are probabilistic.