104.196.23.232📋 Copy

# IP Intelligence Briefing: 104.196.23.232/32

Classification: Low Risk — Google Cloud Infrastructure

Report Date: Current

Risk Score: 25/100

## Executive Summary

IP 104.196.23.232 is a Google Cloud infrastructure address with a low risk profile. No active threat indicators, no malicious services detected, and no persistent malicious activity observed. The IP is associated with googleusercontent.com and operates as a firewalled endpoint with no open ports.

## Infrastructure Profile

## Threat Assessment

• Risk Score: 25 (Low Risk)
• Threat Indicators: None detected
• Blacklist Status: 0 blacklists; 1 DNSBL listing noted
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Abuse Confidence: N/A (Google Cloud infrastructure)

## Network Services

• Open Ports: None detected
• HTTP/HTTPS: No active services
• TLS Certificates: None
• DNS Resolution: 232.23.196.104.bc.googleusercontent.com (confirmed)

## Historical Analysis (22 Observations)

• Observation Period: Signals observed as recently as 2026-08-05
• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Is Persistently Malicious: No
• Stability: Stable (no ownership changes)

Recent signals include routing, DNS, services, ownership, reputation, and geolocation assessments. No escalation in threat indicators over the observation period.

## Neighborhood Analysis (104.196.23.0/24)

• Abuse Density: 0 (Clean)
• Threat Siblings: 0
• Active Siblings: 0
• Total Siblings: 1

The /24 subnet shows no abuse activity. The IP has no known relationships with malicious neighbors.

## Control Plane

• BGP Prefix: 104.196.16.0/20
• Route Stability: Not stable
• RPKI State: N/A
• DNSSEC: Valid
• DNSBL Listed: 1 of 8 lists

## Relationship Graph (11 Relationships)

• DNS Associations: googleusercontent.com (232.23.196.104.bc.googleusercontent.com)
• Network Relationships: GOOGLE-CLOUD (repeated associations)
• No External Threat Relationships: None detected

## Recommended Actions

1. Monitoring: Continue monitoring; no immediate action required

2. Firewall Rules: No blocking recommended; traffic allowed per organizational policy

3. Threat Intelligence: No alert generation warranted

4. Geolocation: Monitor for any changes in reported location (currently Moncks Corner, SC)

## Intelligence Narrative

IP 104.196.23.232 is a legitimate Google Cloud infrastructure address with no malicious indicators. The IP resolves to a Google user content service hostname and operates as a firewalled endpoint with no active services. Historical data shows 22 observations with no persistent malicious activity or ownership changes. The surrounding /24 subnet is clean with no abuse density. The single DNSBL listing is consistent with Google Cloud infrastructure practices and does not indicate malicious activity. No firewall blocking or alerting is recommended. This IP should be treated as trusted cloud infrastructure traffic.

Analyst Notes: Traffic from this IP is consistent with normal Google Cloud operations. No correlation with known threat actors or campaigns.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.