104.155.0.246📋 Copy

IP INTELLIGENCE BRIEFING: 104.155.0.246/32

Classification: Moderate Risk | Report Date: 2026-08-12

---

**EXECUTIVE SUMMARY**

IP address 104.155.0.246 is registered to Google LLC (Google Cloud Infrastructure) with a moderate risk score of 40/100. The IP resolves to Google's content delivery domain (googleusercontent.com) and is associated with Google Cloud network space. While the broader subnet maintains a clean classification, recent observations indicate the IP has been listed on DNS blacklists.

---

**NETWORK IDENTIFICATION**

---

**THREAT ASSESSMENT**

Risk Breakdown:

• Provider Score: 0
• Authority Score: 0
• Operator Score: 0.3478 (Basic)
• ISP Classification: Provider (Google Cloud)
• Infrastructure Type: Unknown
• Service Status: Firewalled/No Services Detected

---

**NEIGHBORHOOD ANALYSIS**

Subnet 104.155.0.246/24 assessment:

• Abuse Density: 0%
• Classification: Clean
• Active Siblings: 1
• Threat Siblings: 0
• Inherited Risk: 0

The /24 subnet shows no broader malicious activity, indicating this IP is an isolated finding rather than part of a coordinated campaign.

---

**OBSERVATION HISTORY**

• Total Observations: 22
• Recent Activity (2026-08-12):

- DNSBL listing detected (high severity, 1 of 8 lists)

- DNSSEC validation: Valid

- CAA records present

• Historical Trend: Subnet classified as clean as of 2026-08-05; recent DNSBL activity represents new threat indicators.

---

**RELATIONSHIP MAPPING**

• DNS Associations: 246.0.155.104.bc.googleusercontent.com (multiple records)
• Network Associations: GOOGLE-CLOUD (repeated)
• External Links: None detected

---

**RECOMMENDED ACTIONS**

Firewall Rules Generated:

```

iptables -A INPUT -s 104.155.0.246 -j DROP

nft add rule inet filter input ip saddr 104.155.0.246 drop

nginx: deny 104.155.0.246;

pfSense: 104.155.0.246/32

```

Decision Matrix:

---

**SOC ANALYST NOTES**

1. Context: IP is part of Google Cloud infrastructure with legitimate reverse DNS resolution to googleusercontent.com.

2. Threat Indicators: 2 DNSBL listings warrant attention but lack associated threat indicators (malware, spam, scanning).

3. Isolation: No neighboring IPs in /24 subnet show malicious activity.

4. Action: Implement blocking at perimeter firewall if risk tolerance requires; monitor for traffic patterns consistent with malicious activity.

---

*Intelligence generated via IPDebrief platform. Verify all actions against local security policies and traffic context.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.