# 104.28.159.143 — IP Intelligence Summary

104.28.159.143 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to New York, United States. As of September 1, 2026, IPDebrief rates it Moderate Risk (40/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/104.28.159.143
- Last updated: 2026-09-01

## Ownership

- Organization: Cloudflare, Inc.
- Network name: CLOUDFLARENET
- Allocated block: 104.16.0.0/12
- ASN: AS13335 (https://ipdebrief.com/asn/13335)
- Regional registry: ARIN

## Location

- City: New York
- Region: New York
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Moderate Risk (40/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# INTELLIGENCE BRIEFING: 104.28.159.143

\## Executive Summary

IP address 104.28.159.143 is associated with Cloudflare, Inc. (ASN 13335) and presents a moderate risk profile (score: 40). The IP is classified within the CLOUDFLARENET CIDR block (104.16.0.0/12) and geolocations to New York, US. Despite legitimate CDN infrastructure, the address shows evidence of security indicator engagement including DNSBL listings.

\---

\## Ownership and Infrastructure

| Attribute | Value |

|-----------|-------|

| **Organization** | Cloudflare, Inc. |

| **ASN** | 13335 |

| **Network** | CLOUDFLARENET (104.16.0.0/12) |

| **Geolocation** | New York, US |

| **Network Role** | Firewalled / No Services |

| **DNS Status** | No PTR records; no forward resolution |

The IP shows no active services or open ports, consistent with CDN infrastructure that terminates traffic at edge locations.

\---

\## Risk Assessment

\- **Overall Risk Score:** 40 (Moderate Risk)

\- **Risk Classification:** Moderate

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Tor Exit Node:** No

\- **Blacklist Count:** 0 (threat indicators)

**Control Plane Indicators:**

\- DNSBL Listed: 2/8 total lists (high severity)

\- Route Stability: False

\- DNSSEC Valid: True

\---

\## Neighborhood Analysis

| Metric | Value |

|--------|-------|

| **Subnet** | 104.28.159.0/24 |

| **Abuse Density** | 0.1224 (12.24%) |

| **Classification** | Mostly Clean |

| **Total Siblings** | 49 |

| **Active Siblings** | 30 |

| **Threat Siblings** | 6 |

| **High-Risk Neighbors** | 0 |

| **Medium-Risk Neighbors** | 16 |

The /24 subnet maintains low abuse density with 6 threat siblings among 49 total IPs, suggesting the network is generally well-maintained.

\---

\## Threat History

**Observation Count:** 16 signals tracked

**Recent Activity (2026-07-27):**

\- Geo validation: ICMP blocked; unable to validate (5,968.4 km distance to claimed location)

\- DNSBL listings detected (8 total lists, 2 high-severity)

\- Abuse density signal: Mostly clean classification

\- No persistent malicious behavior observed

\---

\## Relationship Graph

All detected relationships link to CLOUDFLARENET network infrastructure. No connections to malicious organizations, campaigns, or certificate authorities were identified.

\---

\## Recommended Actions

Based on risk profile, the following defensive measures are recommended:

\### Firewall Rules

| Platform | Rule |

|----------|------|

| iptables | \`iptables -A INPUT -s 104.28.159.143 -j DROP\` |

| nftables | \`nft add rule inet filter input ip saddr 104.28.159.143 drop\` |

| nginx | \`deny 104.28.159.143;\` |

| pfSense | \`104.28.159.143/32\` |

| Cloudflare WAF | Block 104.28.159.143 — IPDebrief risk score 40 |

| AWS WAF | Address: 104.28.159.143/32 — Description: IPDebrief risk 40 |

\---

\## Analyst Notes

The IP address belongs to legitimate Cloudflare CDN infrastructure. However, the presence of DNSBL listings and moderate risk score warrants continued monitoring. The lack of active services suggests the IP may be used for traffic termination or edge caching functions. The 12.24% abuse density in the /24 subnet is within acceptable ranges for CDN networks.

**Classification:** Moderate Risk — Monitor with recommended firewall rules

## Nearby addresses

- 104.28.159.2 (https://ipdebrief.com/104.28.159.2)
- 104.28.159.4 (https://ipdebrief.com/104.28.159.4)
- 104.28.159.7 (https://ipdebrief.com/104.28.159.7)
- 104.28.159.8 (https://ipdebrief.com/104.28.159.8)
- 104.28.159.17 (https://ipdebrief.com/104.28.159.17)
- 104.28.159.20 (https://ipdebrief.com/104.28.159.20)
- 104.28.159.21 (https://ipdebrief.com/104.28.159.21)
- 104.28.159.44 (https://ipdebrief.com/104.28.159.44)
- 104.28.159.45 (https://ipdebrief.com/104.28.159.45)
- 104.28.159.46 (https://ipdebrief.com/104.28.159.46)
- 104.28.159.47 (https://ipdebrief.com/104.28.159.47)
- 104.28.159.48 (https://ipdebrief.com/104.28.159.48)

---

Source: IPDebrief, "104.28.159.143 IP intelligence", https://ipdebrief.com/104.28.159.143, updated 2026-09-01. Assessments are probabilistic.