# 104.28.159.97 — IP Intelligence Summary

104.28.159.97 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to New York, United States. As of September 1, 2026, IPDebrief rates it Low Risk (25/100); no anonymizing service was detected.

- Canonical page: https://ipdebrief.com/104.28.159.97
- Last updated: 2026-09-01

## Ownership

- Organization: Cloudflare, Inc.
- Network name: CLOUDFLARENET
- Allocated block: 104.16.0.0/12
- ASN: AS13335 (https://ipdebrief.com/asn/13335)
- Regional registry: ARIN

## Location

- City: New York
- Region: New York
- Country: United States
- Time zone: —

## Network classification

- Infrastructure type: —
- Datacenter / hosting: no
- Residential: no
- Mobile: no
- Anycast: no
- Tor exit node: no
- VPN: no
- Proxy: no

## Risk assessment

- Assessment: Low Risk (25/100)
- Blocklist listings: 0
- Suspicious activity indicators: no
- Spam source: no

## Analyst narrative

\## IP Intelligence Briefing: 104.28.159.97

**Classification:** Low Risk - CDN Infrastructure

**Analysis Date:** 2026-07-27

**Analyst:** IPDebrief Intelligence Team

\---

\### Executive Summary

IP 104.28.159.97 is classified as a Cloudflare CDN endpoint (ASN 13335) with a low risk score of 25. The IP exhibits normal CDN behavior with no open services and is part of a predominantly clean subnet (104.28.159.0/24). No active malicious campaigns or threat indicators were detected.

\---

\### Ownership & Infrastructure

| Field | Value |

|-------|-------|

| **Organization** | Cloudflare, Inc. |

| **ASN** | 13335 (CLOUDFLARENET) |

| **CIDR Block** | 104.16.0.0/12 |

| **Geolocation** | United States (New York region) |

| **Network Role** | Firewalled / No Services |

The IP belongs to Cloudflare's global content delivery network infrastructure. Multiple geolocation sources report US placement, though some sources show Kansas coordinates with low confidence (2500km accuracy radius).

\---

\### Risk Assessment

| Metric | Score | Assessment |

|--------|-------|------------|

| **Overall Risk Score** | 25 | Low Risk |

| **Provider Score** | 0 | Neutral |

| **Authority Score** | 0 | Neutral |

| **Abuse Confidence** | N/A | Not Applicable |

| **DNSBL Listings** | 1 of 8 | Minimal |

| **Threat Observation Count** | 1 | Single event |

**Key Findings:**

\- No known attacker indicators

\- Not identified as a spam source

\- Not a Tor exit node

\- No associated threat campaigns

\- IP is not persistently malicious

\---

\### Network Neighborhood Analysis

**Subnet:** 104.28.159.0/24

| Metric | Value |

|--------|-------|

| Total Siblings | 49 |

| Active Siblings | 30 |

| Threat Siblings | 6 |

| Abuse Density | 0.1224 (12.24%) |

| Classification | Mostly Clean |

| Inherited Risk | 4/100 |

The subnet maintains a clean profile with 6 threat siblings out of 49 total. Notable neighbor IPs include 104.28.159.4 (risk 70) and 104.28.159.8 (risk 50), indicating sporadic but contained risk within the subnet.

\---

\### Observation History

**Total Observations:** 15 signals

Recent activity indicates:

\- One high-severity DNSBL listing detected

\- Multiple geolocation signals from diverse sources (MaxMind GeoLite2, Cymru)

\- No ownership changes observed

\- Threat persistence days: 0

The IP has maintained stable ownership with no significant reputation degradation.

\---

\### Service & DNS Analysis

| Service Type | Status |

|--------------|--------|

| **Open Ports** | None detected |

| **DNS Forward Resolution** | 0 records |

| **PTR Hostnames** | None |

| **TLS Certificate** | None |

| **HTTP Service** | None |

The IP is configured as a firewalled endpoint with no publicly accessible services, which is consistent with CDN infrastructure architecture.

\---

\### Recommended Actions

**For SOC/Security Operations:**

1. **Allow Traffic:** No blocking recommended. This is legitimate CDN infrastructure.

2. **Traffic Monitoring:** Monitor for unusual volume patterns that may indicate abuse of CDN services.

3. **Subnet Context:** Be aware of 6 threat siblings in the 104.28.159.0/24 subnet; evaluate traffic from 104.28.159.4 and 104.28.159.8 if anomalies detected.

**Firewall Rules:** No specific firewall rules required. Standard CDN traffic policies apply.

\---

\### Intelligence Conclusions

This IP represents normal Cloudflare CDN infrastructure with no active malicious indicators. The low risk score, combined with the absence of open services and threat indicators, indicates legitimate use. Security operations should treat traffic from this IP as expected CDN activity unless specific behavioral anomalies emerge.

**Threat Level:** LOW

**Action Required:** MONITOR / ALLOW

## Nearby addresses

- 104.28.159.2 (https://ipdebrief.com/104.28.159.2)
- 104.28.159.4 (https://ipdebrief.com/104.28.159.4)
- 104.28.159.7 (https://ipdebrief.com/104.28.159.7)
- 104.28.159.8 (https://ipdebrief.com/104.28.159.8)
- 104.28.159.17 (https://ipdebrief.com/104.28.159.17)
- 104.28.159.20 (https://ipdebrief.com/104.28.159.20)
- 104.28.159.21 (https://ipdebrief.com/104.28.159.21)
- 104.28.159.44 (https://ipdebrief.com/104.28.159.44)
- 104.28.159.45 (https://ipdebrief.com/104.28.159.45)
- 104.28.159.46 (https://ipdebrief.com/104.28.159.46)
- 104.28.159.47 (https://ipdebrief.com/104.28.159.47)
- 104.28.159.48 (https://ipdebrief.com/104.28.159.48)

---

Source: IPDebrief, "104.28.159.97 IP intelligence", https://ipdebrief.com/104.28.159.97, updated 2026-09-01. Assessments are probabilistic.