104.28.157.31📋 Copy

# IP Intelligence Briefing: 104.28.157.31/32

## Executive Summary

Analysis of IP address 104.28.157.31 indicates Low Risk status with a risk score of 25. The address belongs to Cloudflare (ASN 13335), a major CDN and DDoS mitigation provider. The IP is classified as "Firewalled / No Services" with no open ports or active threat indicators. While one DNSBL listing was identified, the overall profile suggests benign CDN infrastructure.

## Risk Assessment

• Overall Risk Score: 25/100 (Low Risk)
• Reputation: Low Risk
• Abuse Confidence Score: Not applicable
• Blacklist Status: Listed on 1 of 8 DNSBLs
• Threat Indicators: None detected
• Known Campaigns: None identified
• Campaign Likelihood: Not applicable

## Technical Profile

Ownership & Routing

• ASN: 13335 (Cloudflare, Inc.)
• BGP Prefix: 104.28.157.0/24
• Origin ASN: 13335
• RPKI State: Not evaluated
• Route Stability: Not stable (route changes observed)
• RIR Registry: APNIC (based on Japan geolocation)

Geolocation

• Country: Japan (JP)
• Region: Chiba
• City: Narita
• Accuracy Radius: 2500 km
• Geo Validation: Inconsistent signals detected (one signal indicated US geolocation, another indicated Japan)

Network Classification

• Infrastructure Type: Cloud CDN
• Connection Type: Anycast (inferred from Cloudflare ASN)
• Service Purpose: Firewalled / No Services
• Open Ports: None detected
• DNSSEC: Valid

DNS Analysis

• PTR Hostnames: None resolved
• Forward Resolution: None detected
• Hosted Domains: 0
• Email Authentication: No SPF or DMARC records detected
• TXT Records: 0

## Neighborhood Analysis (104.28.157.0/24)

• Total Sibling IPs: 41
• Subnet Abuse Density: 2.4%
• Risk Distribution:

- High Risk: 1 IP

- Medium Risk: 8 IPs

- Low Risk: 16 IPs

Notable High-Risk Neighbors:

• 104.28.157.3 (Risk: 70, Authority: 85)
• 104.28.157.117 (Risk: 80, Authority: 85)
• 104.28.157.118 (Risk: 65, Authority: 85)

The subnet shows typical Cloudflare CDN behavior with most addresses being low-risk. The presence of one high-risk neighbor and several medium-risk addresses is consistent with CDN infrastructure hosting multiple services.

## Observation History

Seven signal observations were recorded, with the most recent activity on 2026-07-25. Key signals include:

• DNSSEC validation (valid RRSIG)
• DNSBL listing (high severity category)
• Conflicting geolocation signals (US and JP)
• Minimal threat indicators

## Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• WAF Violations: 0
• Honeypot Hits: 0
• Enumeration Strikes: 0
• Total Incidents: 0

## Recommended Actions

No specific firewall rules or blocking recommendations are generated based on current risk profile. The IP is classified as benign CDN infrastructure. However, analysts should:

1. Monitor the one DNSBL listing for changes

2. Allow traffic through standard CDN firewall rules (Cloudflare IPs are typically legitimate)

3. Log any unusual traffic patterns from this IP, though no current threat activity detected

## Intelligence Conclusion

IP 104.28.157.31 is Cloudflare CDN infrastructure with a low risk profile. The single DNSBL listing appears to be a false positive or acceptable listing for CDN services. No immediate blocking or mitigation actions are recommended. This IP should be treated as legitimate CDN traffic unless additional threat intelligence indicates otherwise.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.