136.108.90.156📋 Copy

# IP Intelligence Briefing: 136.108.90.156/32

## Executive Summary

IP address 136.108.90.156 is registered to Google LLC (ASN 396982) and operates within the GOOGL-2 network (136.107.0.0/16). The IP carries a moderate risk score of 50 with 2 DNSBL listings. Geolocation data indicates South Carolina, US, but RTT analysis flags a 6,958 km distance violation, suggesting unreliable location data. No active threat campaigns or known attacker indicators are present.

## Threat Assessment

Risk Profile: Moderate Risk (Score: 50)

• Threat Indicators: None detected; 0 known attacker flags, 0 spam source flags, 0 Tor exit node flags
• Abuse Signals: 2 DNSBL listings out of 8 total lists; 0 blacklist entries in threat feeds
• Campaign Correlation: 0 certificate matches, 0 correlated IPs, 0 campaign associations
• Persistence: Single threat observation recorded; not persistently malicious

Network Classification:

• Provider: Google Cloud
• Infrastructure Type: Single-Service Host
• Connection Type: Unknown
• Control Plane: Route stable, DNSSEC valid, CAA record present
• Operator Score: 0.3478 (Basic)

## Service Exposure

• Port 22/TCP: Open (SSH-2.0-OpenSSH_10.0)
• DNS Resolution: 156.90.108.136.bc.googleusercontent.com
• Email Authentication: SPF and DMARC records present
• TLS Certificate: None observed
• HTTP Services: No web services detected

## Neighborhood Analysis

• Subnet: 136.108.90.156/24
• Abuse Density: 0.0 (clean)
• Active Siblings: 0
• Threat Siblings: 0
• Neighbor Count: 1 (136.108.90.100)

## Historical Observations

Total of 26 observations recorded. Most recent activity detected on 2026-08-05. Signal types include geolocation traces, ownership verification, and threat correlation events. No persistent malicious behavior pattern observed.

## Recommended Actions

The following firewall rules have been generated based on the IP's risk profile:

## Analyst Notes

This IP belongs to Google Cloud infrastructure. While the moderate risk score and presence of open SSH suggest caution, the clean neighborhood profile and lack of campaign associations indicate this may be legitimate cloud infrastructure. The geolocation discrepancy (6,958 km with RTT violation) should be considered when evaluating the South Carolina location data. SOC teams should evaluate the open SSH port in context of their threat environment before implementing blocking rules.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.