104.28.158.121📋 Copy

# IP Intelligence Briefing: 104.28.158.121/32

Classification: CDN Infrastructure / Low Risk

Date of Analysis: 2026-07-24

## Executive Summary

Intellectual analysis of 104.28.158.121/32 confirms classification as Cloudflare CDN infrastructure with low-risk operational characteristics. The IP addresses to AS13335 (CLOUDFLARENET) and operates within the 104.16.0.0/12 CIDR block. No active threat indicators, blacklist entries, or malicious campaign associations detected.

## Infrastructure Profile

• Organization: Cloudflare, Inc.
• ASN: 13335 (CLOUDFLARENET)
• Geolocation: Amsterdam, North Holland, US
• Infrastructure Type: Content Delivery Network (CDN)
• Network Role: CDN with firewall protection; no open services detected
• Risk Score: 0
• Provider/Authority Scores: 0 (neutral classification)

## Threat Indicators Assessment

• Blacklist Status: Zero listings across all threat feeds
• Malicious Indicators: No known attacker, spam source, or Tor exit point associations
• Campaign Affiliations: No correlated campaigns or certificate matches
• Threat Persistence: Zero observation days; not persistently malicious
• Control Plane: Route stability flagged as false; RPKI and IRR states not validated

## Neighborhood Context (104.28.158.0/24)

The /24 subnet demonstrates mixed risk distribution typical of CDN infrastructure:

• Total Siblings: 41 IPs
• Abuse Density: 0.0976 (low-moderate)
• Subnet Classification: Mostly clean
• Risk Distribution: 3 high-risk, 25 medium-risk, 6 low-risk neighbors
• Active Threat Siblings: 4 IPs flagged for suspicious activity

Notable neighbor IPs with elevated risk scores include 104.28.158.14, 104.28.158.123, and 104.28.158.228 (all scoring 80). The majority of neighbors maintain authority scores of 85, indicating consistent infrastructure management.

## Historical Observations

Fourteen signal observations recorded between 2026-07-24:

• Geolocation signals consistently resolved to US region with confidence ranging 0.35–0.85
• Network classification confirmed CDN status across multiple observations
• Abuse density signals maintained consistent "mostly_clean" classification
• No ownership changes or threat persistence events detected
• DNS and service signals show no forward resolution or open port activity

## Operational Recommendations

1. Allow Traffic: No blocking recommended for inbound CDN traffic on this IP

2. Monitoring: Standard CDN traffic patterns; monitor for unusual outbound connections

3. Rule Configuration: No firewall rules required; standard Cloudflare IP reputation handling applies

4. Context: Traffic from this IP represents legitimate CDN infrastructure, not malicious activity

Analyst Note: This IP is part of Cloudflare's global CDN network. Traffic patterns should be evaluated against expected CDN behavior rather than treated as potential threats. The subnet's abuse density of 0.075 is within normal ranges for CDN infrastructure.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.