104.28.164.157📋 Copy

# IP Intelligence Briefing: 104.28.164.157/32

## Executive Summary

The target IP 104.28.164.157 is a Cloudflare CDN endpoint (ASN 13335) with an overall low-risk profile (risk score 25). No direct threat indicators, blacklist entries, or active attack signatures were identified. The IP operates as a firewalled infrastructure component with no open services.

## Infrastructure Classification

• Organization: Cloudflare, Inc. (CLOUDFLARENET)
• ASN: 13335
• Network Block: 104.16.0.0/12
• Geolocation: Reston, Virginia, US
• Infrastructure Type: CDN/Edge Infrastructure
• Service State: Firewalling detected, no active services exposed
• DNSSEC: Valid

## Threat Assessment

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not applicable (CDN infrastructure)
• Blacklist Status: 0 entries
• Known Threat Campaigns: None identified
• Tor Exit/Proxy: No
• Known Attacker: No

## Subnet Context (104.28.164.0/24)

• Total Siblings: 37
• Active Siblings: 18
• Abuse Density: 0.028 (moderate)
• Risk Distribution: 1 high-risk, 26 medium-risk, 7 low-risk neighbors
• Notable High-Risk Neighbors:

- 104.28.164.245 (risk: 80)

- 104.28.164.239 (risk: 65)

- Multiple addresses with risk scores 55-60

## Observation History (Last 14 Signals)

Recent observations (2026-07-27) indicate:

• Subnet classification: "mostly_clean"
• Inherited risk: 2
• Listed on 8 threat feeds (1 listing active)
• Threat persistence: None detected
• Ownership stability: No changes observed

## Operational Notes

• The IP functions as a Cloudflare edge node, likely terminating TLS traffic and providing DDoS mitigation.
• Firewalling is active on this IP, preventing direct service enumeration.
• DNSSEC validation is enabled.
• Control plane shows route stability issues flagged (isRouteStable: false) but no route changes in 30 days.

## Recommended Actions

• No immediate blocking required. This is legitimate CDN infrastructure.
• Monitor for unusual traffic patterns from this IP during incident response.
• If investigating a specific attack involving this IP, correlate with Cloudflare's security dashboard.
• Be aware that the /24 subnet contains elevated-risk neighbors (1 high-risk, 26 medium-risk) — these may require separate investigation if associated with malicious activity.

## Conclusion

104.28.164.157 is legitimate Cloudflare CDN infrastructure with no direct threat indicators. The IP's low-risk profile is consistent with its role as a content delivery edge node. No defensive action required beyond standard monitoring.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.