104.196.20.152📋 Copy

IP INTELLIGENCE BRIEFING: 104.196.20.152/32

---

**Executive Summary**

The target IP address 104.196.20.152/32 is classified as a Google Cloud infrastructure endpoint with a low overall risk score of 25. The IP shows no active threat indicators, is not associated with known malicious campaigns, and operates within a clean neighborhood subnet.

---

**Ownership and Network Classification**

• Organization: Google LLC (ASN 396982)
• Network Block: 104.196.0.0/14 (GOOGLE-CLOUD)
• Infrastructure Type: Cloud Compute
• Classification: Cloud infrastructure, not CDN, VPN, proxy, or hosting service

The IP resolves to the reverse hostname `152.20.196.104.bc.googleusercontent.com`, confirming Google Cloud Platform origin. DNSSEC validation is active, and the IP is properly delegated within the RIR registry.

---

**Geolocation**

• Country: United States (US)
• Region/State: South Carolina (SC)
• City: Moncks Corner
• Coordinates: 33.21°N, -80.17°W
• Accuracy: 150 km radius

---

**Threat Indicators and Reputation**

• Risk Score: 25 (Low Risk)
• Abuse Confidence: Not available
• Blacklist Status: Listed on 8 DNS blacklist entries (1 high severity listing)
• Threat Feeds: No indicators found
• Known Attacker: False
• Tor Exit Node: False
• Spam Source: False

The IP is not currently flagged as a known malicious source. No threat persistence or persistent malicious behavior was observed.

---

**Network Behavior and Services**

• Open Ports: None detected
• Active Services: No services open
• Connection Type: None observed
• Connection State: Firewalled / No services accessible

The IP appears to be a backend infrastructure endpoint with no public-facing services exposed.

---

**Subnet Analysis**

• Subnet: 104.196.20.0/24
• Abuse Density: 0 (clean)
• Neighbor Count: 1
• Threat Siblings: 0
• Classification: Clean

The surrounding /24 subnet shows no abuse activity, supporting the conclusion that this is legitimate cloud infrastructure.

---

**Observation History**

Historical monitoring shows 21 observations as of 2026-08-12:

• Cloud Infrastructure: Confirmed Google Cloud presence
• DNS Lists: Listed on 8 DNS blacklists
• Operator Score: 0.3478 (Basic classification)
• Geographic Validation: ICMP probes blocked, unable to validate via RTT

No significant changes in risk posture over the observation period.

---

**Relationship Graph**

• DNS Associations: Multiple associations to `152.20.196.104.bc.googleusercontent.com`
• Network Relationships: Multiple Same Network entries pointing to GOOGLE-CLOUD
• No External Associations: No links to suspicious hostnames or organizations

---

**Recommended Actions**

Based on the risk profile, no defensive actions are required:

• Firewall Rules: No blocking recommended
• Monitoring: Standard monitoring appropriate
• Threat Hunting: No immediate threat hunting required

---

**Conclusion**

IP 104.196.20.152/32 is a legitimate Google Cloud infrastructure address with low risk characteristics. The IP shows no malicious activity, operates within a clean neighborhood, and is properly classified as cloud compute infrastructure. SOC teams should treat this as benign infrastructure and may continue standard monitoring without additional scrutiny.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.