# 104.28.160.110 — IP Intelligence Summary 104.28.160.110 is an IPv4 address operated by Cloudflare, Inc. (AS13335), geolocated to Bennett, United States. It belongs to datacenter or hosting infrastructure. As of October 7, 2026, IPDebrief rates it High Risk (80/100); no anonymizing service was detected. - Canonical page: https://ipdebrief.com/104.28.160.110 - Last updated: 2026-10-07 ## Ownership - Organization: Cloudflare, Inc. - Network name: CLOUDFLARENET - Allocated block: 104.16.0.0/12 - ASN: AS13335 (https://ipdebrief.com/asn/13335) - Regional registry: ARIN ## Location - City: Bennett - Region: Colorado - Country: United States - Time zone: — ## Network classification - Infrastructure type: CDN - Datacenter / hosting: yes - Residential: no - Mobile: no - Anycast: no - Tor exit node: no - VPN: no - Proxy: no ## Risk assessment - Assessment: High Risk (80/100) - Blocklist listings: 0 - Suspicious activity indicators: no - Spam source: no ## Analyst narrative \## IP Intelligence Briefing: 104.28.160.110 **Classification:** CDN Infrastructure Node (Cloudflare) **Report Date:** Current Intelligence Cycle \--- \### Executive Summary IP address 104.28.160.110 resolves to Cloudflare CDN infrastructure (ASN 13335) located in Bennett, Colorado, United States. The IP carries a moderate risk score of 55, primarily driven by DNSBL listings rather than active threat indicators. The address serves as a firewalled CDN endpoint with no accessible services. Neighborhood analysis indicates low abuse density within the /24 subnet. \### Ownership and Infrastructure | Attribute | Value | |-----------|-------| | **Organization** | Cloudflare, Inc. | | **ASN** | 13335 | | **Network** | CLOUDFLARENET (104.16.0.0/12) | | **Geolocation** | Bennett, Colorado, US | | **Infrastructure Type** | CDN | | **Service Status** | Firewalled / No Services | \### Risk Assessment **Overall Risk Score:** 55/100 (Moderate) **Risk Breakdown:** \- **Threat Indicators:** None detected (no known campaigns, attacker attribution, or spam source) \- **Blacklist Status:** 3 listings across 8 total DNSBL feeds (max severity: high) \- **Tor/Proxy:** Not a Tor exit node, proxy, or VPN endpoint \- **Known Attacker:** False \- **Spam Source:** False \### Technical Observations **Network Role:** \- Anycast CDN infrastructure \- No residential, mobile, or hosting characteristics \- DNSSEC valid \- Route stability: Unstable **DNS Analysis:** \- Forward resolution: Confirmed \- PTR records: None \- SPF/DMARC: Not configured (typical for CDN infrastructure) \- Hosted domains: 0 **Services:** \- Open ports: None \- TLS certificate: None exposed \- HTTP title: None exposed \- No WAF violations observed \### Observation History Twelve signal observations recorded. Recent activity (2026-07-22) shows: \- Consistent geolocation to Colorado, US \- DNSSEC validation confirmed \- DNSBL listings observed (3/8 lists) \- Subnet abuse density: 0.0345 (low) No significant threat persistence or ownership changes detected. \### Neighborhood Analysis (104.28.160.0/24) **Subnet Classification:** Clean **Abuse Density:** 0.0345 | Metric | Value | |--------|-------| | Total Siblings | 29 | | Active Siblings | 8 | | Threat Siblings | 1 | | High Risk Neighbors | 0 | | Medium Risk Neighbors | 9 | | Low Risk Neighbors | 10 | **Notable High-Risk Neighbors:** \- 104.28.160.7: Risk 70 (Authority 85) \- 104.28.160.188: Risk 55 (Authority 85) \### Relationships Relationship graph indicates only network-level associations (CLOUDFLARENET). No connections to external organizations, hostnames, or certificates beyond the parent CDN network. \### Recommended Actions Based on the risk profile and infrastructure classification: 1. **No Immediate Blocking Recommended:** This is legitimate CDN infrastructure with no active malicious indicators. 2. **Allow List Consideration:** Consider whitelisting if legitimate traffic to Cloudflare CDN is expected. 3. **Monitoring:** Monitor the associated /24 subnet for escalation in abuse density (currently 0.0345). 4. **DNSBL Investigation:** Review the 3 DNSBL listings to understand specific listing reasons if traffic patterns warrant. \### SOC Analyst Notes \- **Infrastructure Type:** This is a Cloudflare CDN node. Blocking would likely impact legitimate traffic to cloudflare-hosted services. \- **Risk Context:** Moderate risk score reflects DNSBL presence in a high-volume CDN environment where false positives are common. \- **Threat Context:** No active threat indicators. The single "threat sibling" in the subnet is not directly correlated. \- **Operational Recommendation:** Maintain allow policies for CDN traffic. Investigate DNSBL listings only if this specific IP shows anomalous connection patterns. \--- **Intelligence Source:** IPDebrief Intelligence Platform **Data Freshness:** Current (Real-time analysis) **Classification:** Defensive Security Intelligence ## Nearby addresses - 104.28.160.7 (https://ipdebrief.com/104.28.160.7) - 104.28.160.8 (https://ipdebrief.com/104.28.160.8) - 104.28.160.43 (https://ipdebrief.com/104.28.160.43) - 104.28.160.44 (https://ipdebrief.com/104.28.160.44) - 104.28.160.47 (https://ipdebrief.com/104.28.160.47) - 104.28.160.48 (https://ipdebrief.com/104.28.160.48) - 104.28.160.49 (https://ipdebrief.com/104.28.160.49) - 104.28.160.50 (https://ipdebrief.com/104.28.160.50) - 104.28.160.54 (https://ipdebrief.com/104.28.160.54) - 104.28.160.66 (https://ipdebrief.com/104.28.160.66) - 104.28.160.72 (https://ipdebrief.com/104.28.160.72) - 104.28.160.76 (https://ipdebrief.com/104.28.160.76) --- Source: IPDebrief, "104.28.160.110 IP intelligence", https://ipdebrief.com/104.28.160.110, updated 2026-10-07. Assessments are probabilistic.