# 104.28.157.31 — IP Intelligence Summary 104.28.157.31 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to Narita, United States. It belongs to datacenter or hosting infrastructure. As of October 5, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/104.28.157.31 - Last updated: 2026-10-05 ## Ownership - Organization: Cloudflare, Inc. - Network name: CLOUDFLARENET - Allocated block: 104.16.0.0/12 - ASN: AS13335 (https://ipdebrief.com/asn/13335) - Regional registry: ARIN ## Location - City: Narita - Region: Chiba - Country: United States - Time zone: — ## Network classification - Infrastructure type: CDN - Datacenter / hosting: yes - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: Low Risk (25/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \# IP Intelligence Briefing: 104.28.157.31/32 \## Executive Summary Analysis of IP address 104.28.157.31 indicates **Low Risk** status with a risk score of 25. The address belongs to Cloudflare (ASN 13335), a major CDN and DDoS mitigation provider. The IP is classified as "Firewalled / No Services" with no open ports or active threat indicators. While one DNSBL listing was identified, the overall profile suggests benign CDN infrastructure. \## Risk Assessment \- **Overall Risk Score:** 25/100 (Low Risk) \- **Reputation:** Low Risk \- **Abuse Confidence Score:** Not applicable \- **Blacklist Status:** Listed on 1 of 8 DNSBLs \- **Threat Indicators:** None detected \- **Known Campaigns:** None identified \- **Campaign Likelihood:** Not applicable \## Technical Profile \### Ownership & Routing \- **ASN:** 13335 (Cloudflare, Inc.) \- **BGP Prefix:** 104.28.157.0/24 \- **Origin ASN:** 13335 \- **RPKI State:** Not evaluated \- **Route Stability:** Not stable (route changes observed) \- **RIR Registry:** APNIC (based on Japan geolocation) \### Geolocation \- **Country:** Japan (JP) \- **Region:** Chiba \- **City:** Narita \- **Accuracy Radius:** 2500 km \- **Geo Validation:** Inconsistent signals detected (one signal indicated US geolocation, another indicated Japan) \### Network Classification \- **Infrastructure Type:** Cloud CDN \- **Connection Type:** Anycast (inferred from Cloudflare ASN) \- **Service Purpose:** Firewalled / No Services \- **Open Ports:** None detected \- **DNSSEC:** Valid \### DNS Analysis \- **PTR Hostnames:** None resolved \- **Forward Resolution:** None detected \- **Hosted Domains:** 0 \- **Email Authentication:** No SPF or DMARC records detected \- **TXT Records:** 0 \## Neighborhood Analysis (104.28.157.0/24) \- **Total Sibling IPs:** 41 \- **Subnet Abuse Density:** 2.4% \- **Risk Distribution:** \- High Risk: 1 IP \- Medium Risk: 8 IPs \- Low Risk: 16 IPs **Notable High-Risk Neighbors:** \- 104.28.157.3 (Risk: 70, Authority: 85) \- 104.28.157.117 (Risk: 80, Authority: 85) \- 104.28.157.118 (Risk: 65, Authority: 85) The subnet shows typical Cloudflare CDN behavior with most addresses being low-risk. The presence of one high-risk neighbor and several medium-risk addresses is consistent with CDN infrastructure hosting multiple services. \## Observation History Seven signal observations were recorded, with the most recent activity on 2026-07-25. Key signals include: \- DNSSEC validation (valid RRSIG) \- DNSBL listing (high severity category) \- Conflicting geolocation signals (US and JP) \- Minimal threat indicators \## Threat Indicators \- **Tor Exit Node:** No \- **Known Attacker:** No \- **Spam Source:** No \- **WAF Violations:** 0 \- **Honeypot Hits:** 0 \- **Enumeration Strikes:** 0 \- **Total Incidents:** 0 \## Recommended Actions No specific firewall rules or blocking recommendations are generated based on current risk profile. The IP is classified as benign CDN infrastructure. However, analysts should: 1. **Monitor** the one DNSBL listing for changes 2. **Allow** traffic through standard CDN firewall rules (Cloudflare IPs are typically legitimate) 3. **Log** any unusual traffic patterns from this IP, though no current threat activity detected \## Intelligence Conclusion IP 104.28.157.31 is Cloudflare CDN infrastructure with a low risk profile. The single DNSBL listing appears to be a false positive or acceptable listing for CDN services. No immediate blocking or mitigation actions are recommended. This IP should be treated as legitimate CDN traffic unless additional threat intelligence indicates otherwise. ## Nearby addresses - 104.28.157.1 (https://ipdebrief.com/104.28.157.1) - 104.28.157.2 (https://ipdebrief.com/104.28.157.2) - 104.28.157.3 (https://ipdebrief.com/104.28.157.3) - 104.28.157.4 (https://ipdebrief.com/104.28.157.4) - 104.28.157.13 (https://ipdebrief.com/104.28.157.13) - 104.28.157.14 (https://ipdebrief.com/104.28.157.14) - 104.28.157.15 (https://ipdebrief.com/104.28.157.15) - 104.28.157.20 (https://ipdebrief.com/104.28.157.20) - 104.28.157.21 (https://ipdebrief.com/104.28.157.21) - 104.28.157.22 (https://ipdebrief.com/104.28.157.22) - 104.28.157.23 (https://ipdebrief.com/104.28.157.23) - 104.28.157.24 (https://ipdebrief.com/104.28.157.24) --- Source: IPDebrief, "104.28.157.31 IP intelligence", https://ipdebrief.com/104.28.157.31, updated 2026-10-05. Assessments are probabilistic.