# 104.28.159.246 — IP Intelligence Summary

104.28.159.246 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to San Jose, United States. It belongs to datacenter or hosting infrastructure. As of October 6, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/104.28.159.246
- Last updated: 2026-10-06

## Ownership

- Organization: Cloudflare, Inc.
- Network name: CLOUDFLARENET
- Allocated block: 104.16.0.0/12
- ASN: AS13335 (https://ipdebrief.com/asn/13335)
- Regional registry: ARIN

## Location

- City: San Jose
- Region: California
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: CDN
- Datacenter / hosting: yes
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\# IP Intelligence Briefing: 104.28.159.246/32

**Classification:** CDN Infrastructure with Moderate Risk Profile

**Date:** Current Intelligence Assessment

**Source:** IPDebrief Threat Intelligence Platform

\---

\## Executive Summary

IP address 104.28.159.246/32 is identified as a Cloudflare CDN endpoint located in San Jose, California, USA. The address carries a moderate risk score of 40 and operates within the CLOUDFLARENET infrastructure (ASN 13335). No active threat indicators or malicious campaign associations were detected. The subnet exhibits low abuse density (0.0833) with minimal inherited risk.

\---

\## Infrastructure Profile

**Ownership & Classification:**

\- **Organization:** Cloudflare, Inc.

\- **Network Name:** CLOUDFLARENET

\- **ASN:** 13335

\- **CIDR Block:** 104.16.0.0/12

\- **Infrastructure Type:** Content Delivery Network (CDN)

\- **Service Purpose:** Firewalled / No Services (no open ports detected)

**Geolocation:**

\- **Country:** United States (US)

\- **Region:** California (CA)

\- **City:** San Jose

\- **Coordinates:** 36.78°N, -119.42°W

\- **Timezone:** America/Los_Angeles

\---

\## Threat Assessment

**Risk Indicators:**

\- **Risk Score:** 40 (Moderate Risk)

\- **Abuse Confidence Score:** Not reported

\- **Known Attacker:** No

\- **Spam Source:** No

\- **Tor Exit Node:** No

\- **Blacklist Count:** 0

\- **DNSBL Listed:** 2 of 8 lists

**Control Plane Data:**

\- **Operator Score:** 0.1304 (Minimal)

\- **Route Stability:** Unstable

\- **DNSSEC Valid:** Yes

\- **IRR Consistency:** Not reported

\- **Threat Persistence:** None detected

\---

\## Neighborhood Analysis (104.28.159.0/24)

**Subnet Statistics:**

\- **Total Siblings:** 48

\- **Active Siblings:** 20

\- **Threat Siblings:** 4

\- **Abuse Density:** 0.0833 (Low)

\- **Classification:** Mostly Clean

**Risk Distribution in Subnet:**

\- High Risk: 0 IPs

\- Medium Risk: 10 IPs

\- Low Risk: 18 IPs

\---

\## Historical Observations

**Observation Count:** 13 signals recorded

**Key Historical Signals:**

\- Multiple geolocation sources with confidence levels ranging from 0.30 to 0.85

\- Subnet abuse density classification consistent across observations

\- No persistent malicious activity detected

\- Ownership changes: 0

\- Threat observation count: 0

\---

\## Relationship Network

All identified relationships link to **CLOUDFLARENET** network infrastructure. No external organizational connections, hostnames, or certificates outside the Cloudflare ecosystem were identified.

\---

\## Recommended Security Actions

**Firewall Rules Generated:**

\`\`\`

iptables: iptables -A INPUT -s 104.28.159.246 -j DROP

nftables: nft add rule inet filter input ip saddr 104.28.159.246 drop

nginx: deny 104.28.159.246;

pfSense: 104.28.159.246/32

Cloudflare WAF: Block (risk score 40)

AWS WAF: 104.28.159.246/32

\`\`\`

**Assessment:** While automated rules recommend blocking, the IP operates as a legitimate CDN endpoint with moderate risk classification. Blocking may disrupt legitimate traffic. Contextual analysis required before implementing blocking measures.

\---

\## Intelligence Assessment

This IP address represents Cloudflare CDN infrastructure with a moderate risk profile. The absence of threat indicators, zero blacklist matches, and low neighborhood abuse density suggest this endpoint is primarily engaged in legitimate content delivery activities. The moderate risk score likely reflects general CDN traffic patterns rather than malicious activity.

**Recommendation:** Monitor traffic patterns for anomalies. If blocking is required for operational security, implement during low-traffic windows with appropriate logging. Consider allowing traffic unless specific threat correlation indicates malicious activity.

## Nearby addresses

- 104.28.159.2 (https://ipdebrief.com/104.28.159.2)
- 104.28.159.4 (https://ipdebrief.com/104.28.159.4)
- 104.28.159.7 (https://ipdebrief.com/104.28.159.7)
- 104.28.159.8 (https://ipdebrief.com/104.28.159.8)
- 104.28.159.17 (https://ipdebrief.com/104.28.159.17)
- 104.28.159.20 (https://ipdebrief.com/104.28.159.20)
- 104.28.159.21 (https://ipdebrief.com/104.28.159.21)
- 104.28.159.44 (https://ipdebrief.com/104.28.159.44)
- 104.28.159.45 (https://ipdebrief.com/104.28.159.45)
- 104.28.159.46 (https://ipdebrief.com/104.28.159.46)
- 104.28.159.47 (https://ipdebrief.com/104.28.159.47)
- 104.28.159.48 (https://ipdebrief.com/104.28.159.48)

---

Source: IPDebrief, "104.28.159.246 IP intelligence", https://ipdebrief.com/104.28.159.246, updated 2026-10-06. Assessments are probabilistic.