# 104.28.158.121 — IP Intelligence Summary

104.28.158.121 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to Amsterdam, Netherlands. It belongs to datacenter or hosting infrastructure. As of August 29, 2026, IPDebrief rates it Low Risk (0/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/104.28.158.121
- Last updated: 2026-08-29

## Ownership

- Organization: Cloudflare, Inc.
- Network name: CLOUDFLARENET
- Allocated block: 104.16.0.0/12
- ASN: AS13335 (https://ipdebrief.com/asn/13335)
- Regional registry: ARIN

## Location

- City: Amsterdam
- Region: North Holland
- Country: Netherlands
- Time zone: —

## Network classification

- Infrastructure type: CDN
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (0/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 104.28.158.121/32

**Classification:** CDN Infrastructure / Low Risk

**Date of Analysis:** 2026-07-24

\## Executive Summary

Intellectual analysis of 104.28.158.121/32 confirms classification as Cloudflare CDN infrastructure with low-risk operational characteristics. The IP addresses to AS13335 (CLOUDFLARENET) and operates within the 104.16.0.0/12 CIDR block. No active threat indicators, blacklist entries, or malicious campaign associations detected.

\## Infrastructure Profile

\- **Organization:** Cloudflare, Inc.

\- **ASN:** 13335 (CLOUDFLARENET)

\- **Geolocation:** Amsterdam, North Holland, US

\- **Infrastructure Type:** Content Delivery Network (CDN)

\- **Network Role:** CDN with firewall protection; no open services detected

\- **Risk Score:** 0

\- **Provider/Authority Scores:** 0 (neutral classification)

\## Threat Indicators Assessment

\- **Blacklist Status:** Zero listings across all threat feeds

\- **Malicious Indicators:** No known attacker, spam source, or Tor exit point associations

\- **Campaign Affiliations:** No correlated campaigns or certificate matches

\- **Threat Persistence:** Zero observation days; not persistently malicious

\- **Control Plane:** Route stability flagged as false; RPKI and IRR states not validated

\## Neighborhood Context (104.28.158.0/24)

The /24 subnet demonstrates mixed risk distribution typical of CDN infrastructure:

\- **Total Siblings:** 41 IPs

\- **Abuse Density:** 0.0976 (low-moderate)

\- **Subnet Classification:** Mostly clean

\- **Risk Distribution:** 3 high-risk, 25 medium-risk, 6 low-risk neighbors

\- **Active Threat Siblings:** 4 IPs flagged for suspicious activity

Notable neighbor IPs with elevated risk scores include 104.28.158.14, 104.28.158.123, and 104.28.158.228 (all scoring 80). The majority of neighbors maintain authority scores of 85, indicating consistent infrastructure management.

\## Historical Observations

Fourteen signal observations recorded between 2026-07-24:

\- Geolocation signals consistently resolved to US region with confidence ranging 0.35–0.85

\- Network classification confirmed CDN status across multiple observations

\- Abuse density signals maintained consistent "mostly_clean" classification

\- No ownership changes or threat persistence events detected

\- DNS and service signals show no forward resolution or open port activity

\## Operational Recommendations

1. **Allow Traffic:** No blocking recommended for inbound CDN traffic on this IP

2. **Monitoring:** Standard CDN traffic patterns; monitor for unusual outbound connections

3. **Rule Configuration:** No firewall rules required; standard Cloudflare IP reputation handling applies

4. **Context:** Traffic from this IP represents legitimate CDN infrastructure, not malicious activity

**Analyst Note:** This IP is part of Cloudflare's global CDN network. Traffic patterns should be evaluated against expected CDN behavior rather than treated as potential threats. The subnet's abuse density of 0.075 is within normal ranges for CDN infrastructure.

## Nearby addresses

- 104.28.158.8 (https://ipdebrief.com/104.28.158.8)
- 104.28.158.10 (https://ipdebrief.com/104.28.158.10)
- 104.28.158.12 (https://ipdebrief.com/104.28.158.12)
- 104.28.158.13 (https://ipdebrief.com/104.28.158.13)
- 104.28.158.14 (https://ipdebrief.com/104.28.158.14)
- 104.28.158.16 (https://ipdebrief.com/104.28.158.16)
- 104.28.158.17 (https://ipdebrief.com/104.28.158.17)
- 104.28.158.22 (https://ipdebrief.com/104.28.158.22)
- 104.28.158.24 (https://ipdebrief.com/104.28.158.24)
- 104.28.158.26 (https://ipdebrief.com/104.28.158.26)
- 104.28.158.44 (https://ipdebrief.com/104.28.158.44)
- 104.28.158.77 (https://ipdebrief.com/104.28.158.77)

---

Source: IPDebrief, "104.28.158.121 IP intelligence", https://ipdebrief.com/104.28.158.121, updated 2026-08-29. Assessments are probabilistic.