104.28.159.148📋 Copy

# IP Intelligence Briefing: 104.28.159.148/32

## Executive Summary

IP address 104.28.159.148 is a Cloudflare CDN infrastructure endpoint with a low-risk profile (Risk Score: 25/100). The IP belongs to Cloudflare's CLOUDFLARENET network (ASN 13335) and presents as a firewalled endpoint with no active services. No active threat indicators were detected during analysis.

## Ownership and Network Classification

• Organization: Cloudflare, Inc.
• ASN: 13335
• Network Block: 104.16.0.0/12 (CLOUDFLARENET)
• BGP Prefix: 104.28.159.0/24
• Classification: CDN/Infrastructure
• Geolocation: United States (New York region per MaxMind; conflicting geolocation data from Cymru indicates Kansas at 39.83°N, 98.58°W)
• DNSSEC: Valid

## Threat Indicators Assessment

• Risk Score: 25 (Low Risk)
• Abuse Confidence Score: Not applicable
• Blacklist Status: Listed on 1 of 8 DNSBL lists
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Active Threat Campaigns: None detected

## Neighborhood Analysis (104.28.159.0/24)

• Total Siblings: 49
• Active Siblings: 30
• Threat Siblings: 6 (12.24% abuse density)
• Subnet Classification: Mostly Clean
• Inherited Risk Score: 4
• Risk Distribution: High (0), Medium (17), Low (26)

Notable neighboring IPs with elevated risk scores include:

• 104.28.159.4: Risk 70, Authority 85
• 104.28.159.8: Risk 50, Authority 50

## Service Status

• Open Ports: None detected
• HTTP/HTTPS Services: None active
• TLS Certificates: None
• Status: Firewalled / No Services

## Historical Observation (Last 16 Signals)

Analysis covers 16 observations with most recent activity on 2026-07-27. Key temporal indicators:

• Threat Observation Count: 1
• Threat Persistence Days: 0
• Ownership Changes: 0
• Persistent Malicious Activity: Not observed

## Control Plane Data

• Route Stability: False
• Route Changes (30d): 0
• MoAS: No
• RPKI State: Not available
• IRR Consistency: Not available
• DNSBL Listed: 1 of 8 lists

## Security Actions

No specific firewall or blocking rules are recommended based on current risk profile. The IP represents legitimate CDN infrastructure with minimal threat exposure.

## Intelligence Narrative

104.28.159.148 is an inactive Cloudflare CDN endpoint with no open services or active connections. The IP is part of a subnet containing 6 known threat-adjacent addresses but maintains a low inherited risk score. While the IP itself shows no malicious behavior, analysts should note the presence of 1 DNSBL listing and 12.24% subnet abuse density. No blocking action is required; standard CDN egress filtering applies.

## Recommendation

Monitor – No immediate action required. The IP represents legitimate infrastructure. Continue standard monitoring for any behavioral changes that may indicate infrastructure compromise.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.