104.28.159.97📋 Copy

## IP Intelligence Briefing: 104.28.159.97

Classification: Low Risk - CDN Infrastructure

Analysis Date: 2026-07-27

Analyst: IPDebrief Intelligence Team

---

Executive Summary

IP 104.28.159.97 is classified as a Cloudflare CDN endpoint (ASN 13335) with a low risk score of 25. The IP exhibits normal CDN behavior with no open services and is part of a predominantly clean subnet (104.28.159.0/24). No active malicious campaigns or threat indicators were detected.

---

Ownership & Infrastructure

The IP belongs to Cloudflare's global content delivery network infrastructure. Multiple geolocation sources report US placement, though some sources show Kansas coordinates with low confidence (2500km accuracy radius).

---

Risk Assessment

Key Findings:

• No known attacker indicators
• Not identified as a spam source
• Not a Tor exit node
• No associated threat campaigns
• IP is not persistently malicious

---

Network Neighborhood Analysis

Subnet: 104.28.159.0/24

The subnet maintains a clean profile with 6 threat siblings out of 49 total. Notable neighbor IPs include 104.28.159.4 (risk 70) and 104.28.159.8 (risk 50), indicating sporadic but contained risk within the subnet.

---

Observation History

Total Observations: 15 signals

Recent activity indicates:

• One high-severity DNSBL listing detected
• Multiple geolocation signals from diverse sources (MaxMind GeoLite2, Cymru)
• No ownership changes observed
• Threat persistence days: 0

The IP has maintained stable ownership with no significant reputation degradation.

---

Service & DNS Analysis

The IP is configured as a firewalled endpoint with no publicly accessible services, which is consistent with CDN infrastructure architecture.

---

Recommended Actions

For SOC/Security Operations:

1. Allow Traffic: No blocking recommended. This is legitimate CDN infrastructure.

2. Traffic Monitoring: Monitor for unusual volume patterns that may indicate abuse of CDN services.

3. Subnet Context: Be aware of 6 threat siblings in the 104.28.159.0/24 subnet; evaluate traffic from 104.28.159.4 and 104.28.159.8 if anomalies detected.

Firewall Rules: No specific firewall rules required. Standard CDN traffic policies apply.

---

Intelligence Conclusions

This IP represents normal Cloudflare CDN infrastructure with no active malicious indicators. The low risk score, combined with the absence of open services and threat indicators, indicates legitimate use. Security operations should treat traffic from this IP as expected CDN activity unless specific behavioral anomalies emerge.

Threat Level: LOW

Action Required: MONITOR / ALLOW

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.