104.28.159.143
104.28.159.143 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to New York, United States. As of September 1, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.
# INTELLIGENCE BRIEFING: 104.28.159.143
## Executive Summary
IP address 104.28.159.143 is associated with Cloudflare, Inc. (ASN 13335) and presents a moderate risk profile (score: 40). The IP is classified within the CLOUDFLARENET CIDR block (104.16.0.0/12) and geolocations to New York, US. Despite legitimate CDN infrastructure, the address shows evidence of security indicator engagement including DNSBL listings.
---
## Ownership and Infrastructure
| Attribute | Value |
|---|---|
| **Organization** | Cloudflare, Inc. |
| **ASN** | 13335 |
| **Network** | CLOUDFLARENET (104.16.0.0/12) |
| **Geolocation** | New York, US |
| **Network Role** | Firewalled / No Services |
| **DNS Status** | No PTR records; no forward resolution |
The IP shows no active services or open ports, consistent with CDN infrastructure that terminates traffic at edge locations.
---
## Risk Assessment
- Overall Risk Score: 40 (Moderate Risk)
- Risk Classification: Moderate
- Known Attacker: No
- Spam Source: No
- Tor Exit Node: No
- Blacklist Count: 0 (threat indicators)
Control Plane Indicators:
- DNSBL Listed: 2/8 total lists (high severity)
- Route Stability: False
- DNSSEC Valid: True
---
## Neighborhood Analysis
| Metric | Value |
|---|---|
| **Subnet** | 104.28.159.0/24 |
| **Abuse Density** | 0.1224 (12.24%) |
| **Classification** | Mostly Clean |
| **Total Siblings** | 49 |
| **Active Siblings** | 30 |
| **Threat Siblings** | 6 |
| **High-Risk Neighbors** | 0 |
| **Medium-Risk Neighbors** | 16 |
The /24 subnet maintains low abuse density with 6 threat siblings among 49 total IPs, suggesting the network is generally well-maintained.
---
## Threat History
Observation Count: 16 signals tracked
Recent Activity (2026-07-27):
- Geo validation: ICMP blocked; unable to validate (5,968.4 km distance to claimed location)
- DNSBL listings detected (8 total lists, 2 high-severity)
- Abuse density signal: Mostly clean classification
- No persistent malicious behavior observed
---
## Relationship Graph
All detected relationships link to CLOUDFLARENET network infrastructure. No connections to malicious organizations, campaigns, or certificate authorities were identified.
---
## Recommended Actions
Based on risk profile, the following defensive measures are recommended:
Firewall Rules
| Platform | Rule |
|---|---|
| iptables | `iptables -A INPUT -s 104.28.159.143 -j DROP` |
| nftables | `nft add rule inet filter input ip saddr 104.28.159.143 drop` |
| nginx | `deny 104.28.159.143;` |
| pfSense | `104.28.159.143/32` |
| Cloudflare WAF | Block 104.28.159.143 — IPDebrief risk score 40 |
| AWS WAF | Address: 104.28.159.143/32 — Description: IPDebrief risk 40 |
---
## Analyst Notes
The IP address belongs to legitimate Cloudflare CDN infrastructure. However, the presence of DNSBL listings and moderate risk score warrants continued monitoring. The lack of active services suggests the IP may be used for traffic termination or edge caching functions. The 12.24% abuse density in the /24 subnet is within acceptable ranges for CDN networks.
Classification: Moderate Risk — Monitor with recommended firewall rules
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Cloudflare, Inc. |
| ASN | AS13335 |
| Network Name | CLOUDFLARENET |
| CIDR Block | 104.16.0.0/12 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS13335 |
| Network Prefix | 104.28.159.0/24 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 0% | 0 | 0 |
| routing | 0% | 0 | 0 |
| services | 25% | 1 | 1 |
| ownership | 25% | 1 | 2 |
| reputation | 0% | 0 | 0 |
| geolocation | 25% | 1 | 1 |
| Overall | 12% | 3 | 4 |
| Data Coherence | Mostly Consistent (85%) — 1 contradiction(s) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-15 10:08:13 UTC |
| Last Seen | 2026-10-06 10:00:45 UTC |
| Profile Built | 2026-09-01 01:30:36 UTC |
| Data Freshness | Live |
| Signal Types | 19 |
| Total Observations | 22 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 104.28.159.143
Who owns the IP address 104.28.159.143?
104.28.159.143 is registered to Cloudflare, Inc.. The address falls within the 104.16.0.0/12 network block. Registration is held at ARIN.
Where is 104.28.159.143 located?
Geolocation data places 104.28.159.143 in New York, New York, United States. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 104.28.159.143 malicious or safe?
104.28.159.143 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.