# 104.28.157.20 — IP Intelligence Summary

104.28.157.20 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to Narita, United States. It belongs to datacenter or hosting infrastructure. As of October 5, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/104.28.157.20
- Last updated: 2026-10-05

## Ownership

- Organization: Cloudflare, Inc.
- Network name: CLOUDFLARENET
- Allocated block: 104.16.0.0/12
- ASN: AS13335 (https://ipdebrief.com/asn/13335)
- Regional registry: ARIN

## Location

- City: Narita
- Region: Chiba
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: CDN
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\## IP Intelligence Briefing: 104.28.157.20

\### **Executive Summary**

Target IP 104.28.157.20 is a low-risk Cloudflare CDN infrastructure endpoint with no active threat indicators. The IP operates as part of Cloudflare's global content delivery network (ASN 13335) and exhibits normal CDN behavior. No blocking or filtering action recommended; standard CDN traffic handling applies.

\### **Ownership & Infrastructure**

\- **Organization**: Cloudflare, Inc.

\- **ASN**: 13335 (CLOUDFLARENET)

\- **CIDR Block**: 104.16.0.0/12

\- **RIR**: ARIN

\- **Abuse Contact**: abuse@cloudflare.com

\- **Registration**: ARIN registry

\### **Geolocation Data**

\- **Country**: Japan (JP)

\- **City**: Narita

\- **Region**: CA

\- **Timezone**: America/Los_Angeles

\- **Geolocation Source**: 1 source (consensus: true)

\- **Accuracy Radius**: 2500 km

\### **Risk Assessment**

\- **Overall Risk Score**: 25 (Low Risk)

\- **Threat Classification**: None

\- **Known Attacker**: No

\- **Spam Source**: No

\- **Tor Exit Node**: No

\- **DNSBL Listings**: 1 of 8 total lists

\- **Operator Score**: 0.1304 (Minimal)

\- **Stability Score**: Stable

\- **Persistence**: No persistent malicious behavior observed

\### **Network Role & Services**

\- **Infrastructure Type**: CDN (Content Delivery Network)

\- **Cloud Provider**: Cloudflare

\- **Anycast**: Yes

\- **Open Ports**: None detected

\- **TLS Certificate**: Not detected

\- **HTTP Services**: Not detected

\- **Connection Type**: CDN/firewalled

\### **Threat Indicators**

\- **Active Threat Indicators**: 0

\- **Campaign Matches**: 0

\- **Correlated IPs**: 0

\- **Certificate Matches**: 0

\- **Banner Matches**: 0

\### **Observation History**

\- **Total Observations**: 10

\- **Time Span**: Recent monitoring period

\- **Consistency**: Consistent CDN classification maintained across all observations

\- **Ownership Changes**: 0

\- **Threat Persistence Days**: 0

\### **Subnet Neighborhood Analysis (104.28.157.0/24)**

\- **Total Neighbors**: 41 IPs in /24 subnet

\- **Abuse Density**: 0.024 (2.4%)

\- **Risk Distribution**:

\- High Risk: 1 IP

\- Medium Risk: 8 IPs

\- Low Risk: 16 IPs

\- **Notable Observations**: Multiple neighbors with authority score of 85, indicating legitimate Cloudflare infrastructure. Risk variations are consistent with CDN subnet behavior where some IPs may be associated with specific services or customer configurations.

\### **Relationship Graph**

\- **Connected Entities**: CLOUDFLARENET (same network)

\- **No external relationships** detected (no associated hostnames, organizations, or certificates beyond network-level)

\### **Recommended Actions**

**No action required**. This IP represents legitimate CDN infrastructure:

1. **Firewall/Network**: Allow normal traffic; no blocking recommended

2. **WAF/IPS**: Standard CDN traffic handling; no specific rules required

3. **SIEM/SOAR**: No alert generation recommended; classify as benign CDN traffic

4. **Threat Hunting**: No active investigation needed

5. **Monitoring**: Continue standard CDN traffic monitoring

\### **Conclusion**

IP 104.28.157.20 is a legitimate Cloudflare CDN endpoint with low risk characteristics. The single DNSBL listing is likely a false positive given the CDN nature and overall low-risk profile. The subnet exhibits typical CDN behavior with normal risk distribution across neighbor IPs. No threat intelligence indicators suggest malicious activity. Treat as benign infrastructure traffic.

## Nearby addresses

- 104.28.157.1 (https://ipdebrief.com/104.28.157.1)
- 104.28.157.2 (https://ipdebrief.com/104.28.157.2)
- 104.28.157.3 (https://ipdebrief.com/104.28.157.3)
- 104.28.157.4 (https://ipdebrief.com/104.28.157.4)
- 104.28.157.13 (https://ipdebrief.com/104.28.157.13)
- 104.28.157.14 (https://ipdebrief.com/104.28.157.14)
- 104.28.157.15 (https://ipdebrief.com/104.28.157.15)
- 104.28.157.21 (https://ipdebrief.com/104.28.157.21)
- 104.28.157.22 (https://ipdebrief.com/104.28.157.22)
- 104.28.157.23 (https://ipdebrief.com/104.28.157.23)
- 104.28.157.24 (https://ipdebrief.com/104.28.157.24)
- 104.28.157.30 (https://ipdebrief.com/104.28.157.30)

---

Source: IPDebrief, "104.28.157.20 IP intelligence", https://ipdebrief.com/104.28.157.20, updated 2026-10-05. Assessments are probabilistic.