104.199.1.77📋 Copy

# IP Intelligence Briefing: 104.199.1.77/32

Classification: Low Risk (Score: 15)

Date of Analysis: 2026-08-13

Intel Type: Cloud Infrastructure Assessment

---

## Executive Summary

The IP address 104.199.1.77 is identified as a Google Cloud infrastructure endpoint (ASN 396982) operating within the 104.196.0.0/14 CIDR block. Current risk assessment indicates low threat profile with no persistent malicious activity observed. The IP resolved to a Googleusercontent.com domain and maintains standard cloud hosting characteristics.

---

## Technical Profile

## Service Exposure

• Port 22/TCP: SSH (OpenSSH 9.2p1 Debian-2+deb12u10)
• HTTP/TLS: No active web services detected
• TLS Certificate: None observed

## Threat Indicators

• Abuse Confidence Score: Not applicable
• Blacklist Count: 0
• DNSBL Listings: 1 of 8 total lists
• Tor Exit Node: False
• Known Attacker: False
• Spam Source: False
• Campaign Correlation: None identified

## Neighborhood Assessment

Subnet analysis of 104.199.1.77/24 indicates a clean environment:

• Abuse Density: 0.0
• Classification: Clean
• Active Threat Siblings: 0
• Inherited Risk: 0

## Observation History

17 total observations recorded as of 2026-08-13. Key findings:

• No ownership changes detected
• No threat persistence observed
• No persistent malicious classification
• Recent scans confirm SSH service operational
• Subnet abuse density remained at 0 across observation period

## Control Plane Intelligence

• BGP Prefix: 104.199.0.0/19
• Route Stability: False
• RPKI State: Not available
• DNSSEC: Valid
• CAA Records: Present
• Operator Score: 0.3478 (Basic)

## Recommended Actions

No specific firewall or blocking recommendations generated. The IP maintains a low-risk profile consistent with legitimate Google Cloud infrastructure. Standard cloud security policies apply. No immediate action required.

---

Analyst Notes: This endpoint exhibits characteristics of Google Cloud's public infrastructure. The presence of a single DNSBL listing warrants periodic monitoring but does not indicate active malicious behavior. SSH service exposure is expected for cloud hosting operations. The IP should be monitored as part of normal cloud infrastructure hygiene practices.

Threat Intelligence Status: CLEAN

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.