104.198.216.220📋 Copy

# THREAT INTELLIGENCE BRIEFING

Target: 104.198.216.220/32

Classification: LOW RISK

Date: 2026-06-20

Analyst: IPDebrief Intelligence Team

---

## EXECUTIVE SUMMARY

IP address 104.198.216.220 is a Google Cloud infrastructure endpoint associated with googleusercontent.com. The IP maintains a low-risk reputation profile (risk score: 25/100) with no active threat indicators. No malicious campaigns, known attackers, or spam source classifications were identified.

---

## INFRASTRUCTURE PROFILE

---

## THREAT INDICATORS

• Risk Score: 25 (Low Risk)
• Threat Indicators: None
• Blacklist Count: 0
• DNSBL Listings: 1 (minor)
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

---

## NETWORK CONTEXT

Subnet: 104.198.216.220/24

• Abuse Density: 1/10 (Low)
• Classification: Mostly Clean
• Threat Siblings: 1
• Active Siblings: 1
• Total Siblings: 1

Control Plane:

• Route Stability: Stable
• DNSSEC Valid: Yes
• RPKI State: Verified
• Operator Score: 0.3478 (Basic)

---

## OBSERVATION HISTORY

Total Observations: 21 signals

Risk Trend: Stable (no escalation)

Persistence: No persistent malicious behavior detected

Key Signals:

• Subnet abuse density maintained at 1 across recent observations
• Geolocation data consistent (Council Bluffs, IA)
• Service scans show no open ports
• ICMP validation blocked (standard for cloud infrastructure)

---

## RELATIONSHIP GRAPH

Total Relationships: 66

• DNS Associations: Multiple records pointing to bc.googleusercontent.com
• Network Associations: GOOGLE-CLOUD network segments
• Same Network: Multiple Google Cloud infrastructure references

---

## RECOMMENDED ACTIONS

Security Action: Monitor

Firewall Rule: Allow (No blocking recommended)

Rationale: This is a legitimate Google Cloud infrastructure endpoint with no malicious indicators. The IP is used for legitimate cloud services (googleusercontent.com). No firewall rules recommended unless the organization has specific blocking policies for Google Cloud IPs.

---

## CONCLUSION

104.198.216.220 presents a minimal threat profile. It is a standard Google Cloud Compute endpoint with no evidence of malicious activity. No immediate action required. SOC teams should continue monitoring for any behavioral changes, but this IP should not be treated as malicious or suspicious.

Confidence Level: HIGH

Data Sources: IPDebrief, Google Cloud Infrastructure Registry, DNS Records, Network Scanning Data

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.