104.196.153.254📋 Copy

# IP Intelligence Briefing: 104.196.153.254/32

Classification: Low Risk – Google Cloud Infrastructure

Report Date: 2026-07-30

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP 104.196.153.254 registered as Google Cloud infrastructure with a risk score of 25. The address exhibits no active threat indicators, no open services, and no historical persistence of malicious activity. The IP belongs to ASN 396982 within BGP prefix 104.196.144.0/20.

---

## Risk Profile

---

## Geolocation Data

• Country: United States
• Region/City: North Charleston, South Carolina (confidence: 0.70)
• ASN: 396982 (null in ownership signals)
• CIDR Block: 104.196.0.0/14 (GOOGLE-CLOUD)
• GeoPlausible: false (multiple conflicting sources)

---

## Network Services & DNS

• PTR Hostname: 254.153.196.104.bc.googleusercontent.com
• Domain: googleusercontent.com
• Open Ports: None detected
• TLS Certificate: Not available
• HTTP Banner: Not available
• Email Auth: SPF record present (hasSPF: true)
• Services: Firewalled / No Services exposed

---

## Threat Indicators

• Tor Exit Node: false
• Known Attacker: false
• Spam Source: false
• Blacklist Count: 0
• Active Threats: None
• Campaign Matches: 0
• Honeypot Hits: 0
• WAF Violations: 0

---

## Observation History (Last 13 Observations)

Signals consistently identified Google LLC ownership with abuse email google-cloud-compliance@google.com. Recent geolocation resolved to North Charleston, SC. No escalation in threat signals detected over the observation window. Ownership changes: 0. Threat persistence days: 0.

---

## Relationships

• DNS Association: 254.153.196.104.bc.googleusercontent.com
• No other entity relationships detected

---

## Neighborhood Analysis

• Subnet: 104.196.153.254/24
• Total Siblings: 0
• Abuse Density: 0
• Threat Siblings: 0
• High-Risk Neighbors: 0

---

## Recommended Actions

SOC Analyst Guidance:

1. Allow Traffic: No blocking recommended. The IP operates as Google Cloud infrastructure with no malicious indicators.

2. Monitor DNSBL: Single DNSBL listing warrants routine monitoring but does not indicate active abuse.

3. No Firewall Rules Required: IP shows no exposed services; existing cloud provider security measures adequate.

4. Correlation: No related malicious entities detected in relationship graph or neighborhood.

Firewall Rule (Optional - For Logging):

```

log iptables -A INPUT -s 104.196.153.254 -j LOG --log-prefix "GCP_104.196.153.254:"

```

---

## Conclusion

IP 104.196.153.254 represents benign Google Cloud infrastructure with no evidence of malicious activity. No defensive blocking actions required. Continue standard monitoring procedures for Google Cloud IP ranges.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.