104.28.159.188
104.28.159.188 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to Aulnay-sous-Bois, France. It belongs to datacenter or hosting infrastructure. As of October 6, 2026, IPDebrief rates it Moderate Risk (65/100); no anonymizing service was detected.
IP INTELLIGENCE BRIEFING: 104.28.159.188
Executive Summary
IP address 104.28.159.188 is a Cloudflare CDN infrastructure endpoint with a moderate risk score of 40. The address operates as part of the CLOUDFLARENET network (ASN 13335) within the 104.16.0.0/12 CIDR block. Analysis indicates this is legitimate CDN infrastructure with no active threat indicators, no known campaigns, and no malicious activity observed.
Infrastructure Profile
The IP resolves to Cloudflare, Inc. infrastructure with infrastructure type classified as CDN. Network classification confirms cloud-based operations with no residential, mobile, or hosting characteristics. The address is firewalled with no services exposed—no open ports detected, no TLS certificates, and no HTTP services active. DNS analysis shows no PTR hostnames, no forward resolution, and no hosted domains.
Geolocation
Multiple geolocation data sources provided conflicting but consistent results. Cymru geolocation identified the IP as located in the United States with coordinates 39.83, -98.58. MaxMind geolocation placed the IP in France, Aulnay-sous-Bois, at coordinates 48.9422, 2.5039. Both positions reflect CDN edge node distribution patterns.
Threat Indicators
No threat indicators were identified. The IP is not a Tor exit node, not a known attacker, and not a spam source. Blacklist count remained at zero throughout analysis. Pulsedive risk data and known campaign associations were not populated. No threat feeds reported positive matches.
Control Plane Analysis
Origin ASN confirmed as 13335 (Cloudflare). BGP prefix 104.28.159.0/24 shows route instability. DNSSEC validation passed. DNSBL listing count of 2 out of 8 total lists indicates minimal operator score of 0.1304, labeled as "Minimal" risk.
Historical Observation
Thirteen observation signals recorded across recent monitoring periods. Ownership changes remained at zero, confirming stable infrastructure ownership. Threat persistence days and threat observation count both remained at zero. The IP is not classified as persistently malicious.
Neighborhood Assessment
The 104.28.159.0/24 subnet contains 48 total sibling IPs with 20 active siblings. Abuse density measured at 0.0833, with subnet classification as "mostly_clean." Risk distribution across the subnet showed zero high-risk IPs, 10 medium-risk IPs, and 18 low-risk IPs. Four threat siblings identified within the broader subnet, but none correlated with this specific address.
Relationship Graph
All four relationship entries mapped to CLOUDFLARENET network infrastructure, confirming the IP operates within established Cloudflare network boundaries.
Recommended Actions
No security actions or firewall rules generated. The IP presents as legitimate CDN infrastructure with no actionable threat indicators requiring blocking or mitigation.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Cloudflare, Inc. |
| ASN | AS13335 |
| Network Name | CLOUDFLARENET |
| CIDR Block | 104.16.0.0/12 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No — PTR hostname does not resolve back to this IP (weak signal) |
🔐 DNS Hygiene
| Hygiene Score | 0% (None) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Not signed |
| CAA | Not configured |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Hosting — Infrastructure provider without advanced routing |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🛡️ Public Network Snapshot
| Origin ASN | AS13335 |
| Network Prefix | 104.28.159.0/24 |
| Route mapping | Found |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 25% | 1 | 1 |
| routing | 25% | 1 | 1 |
| services | 25% | 1 | 1 |
| ownership | 25% | 1 | 2 |
| reputation | 0% | 0 | 0 |
| geolocation | 0% | 0 | 0 |
| Overall | 16% | 4 | 5 |
| Data Coherence | Mostly Consistent (85%) — 1 contradiction(s) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-02 04:20:26 UTC |
| Last Seen | 2026-10-07 08:56:58 UTC |
| Profile Built | 2026-10-06 02:53:20 UTC |
| Data Freshness | Live |
| Signal Types | 16 |
| Total Observations | 17 |
Full dossier details are available via our API.
❓ Frequently Asked Questions About 104.28.159.188
Who owns the IP address 104.28.159.188?
104.28.159.188 is registered to Cloudflare, Inc.. The address falls within the 104.16.0.0/12 network block. Registration is held at ARIN.
Where is 104.28.159.188 located?
Geolocation data places 104.28.159.188 in Aulnay-sous-Bois, Île-de-France, France. IP geolocation is approximate and indicates the network's registered or routed location rather than a precise physical address.
Is 104.28.159.188 malicious or safe?
104.28.159.188 currently carries a moderate risk assessment, meaning some indicators warrant caution, but the evidence is mixed. This assessment is generated from continuously collected signals and can change over time.
Is 104.28.159.188 a VPN, proxy, or data center address?
104.28.159.188 is classified as a content delivery network based on network ownership and behavioural analysis.