136.111.21.196📋 Copy

# IP INTELLIGENCE BRIEFING: 136.111.21.196/32

## Executive Summary

IP address 136.111.21.196 is a Google Cloud infrastructure endpoint operating as a web server. The IP presents low risk (score: 25) with no active threat indicators. Intelligence indicates legitimate cloud infrastructure usage with Kubernetes service association.

## Ownership and Geolocation

• Organization: Google LLC
• ASN: 396982
• Country: United States (IA)
• Location: Council Bluffs
• Network Classification: Cloud Compute / Web Server
• Infrastructure Type: Google Cloud Platform

## Technical Profile

• Open Ports: TCP/443 (HTTPS)
• TLS Configuration: TLS 1.3 (TLS_AES_128_GCM_SHA256 cipher suite)
• HTTP Version: HTTP/2.0
• Certificate Subject: CN=136.111.21.196
• Certificate SANs: kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local
• Response Status: 403 Forbidden
• PTR Record: 196.21.111.136.bc.googleusercontent.com

## Threat Assessment

• Risk Score: 25 (Low Risk)
• Abuse Confidence: None
• Blacklist Count: 0
• Known Campaigns: None
• Is Tor Exit: No
• Is Known Attacker: No
• Is Spam Source: No
• DNSBL Listed: 1 of 8 lists
• Control Plane: Operator score 0.3478 (Basic)

## Network Context

• Subnet Abuse Density: 1 (mostly_clean classification)
• Siblings in /24: 1 active IP, 1 threat sibling
• Route Stability: False
• BGP Prefix: 136.111.0.0/16
• RPKI State: Not evaluated

## Historical Observations (22 signals)

Recent activity indicates active scanning and TLS certificate validation. HTTP/2 endpoints returned 403 status codes. TLS 1.3 connections observed with valid certificate chain. No persistent malicious activity detected.

## Associated Entities

• DNS Associations: 196.21.111.136.bc.googleusercontent.com (multiple records)
• Network Associations: GOOGL-2 (same network)
• Total Relationships: 45

## Recommended Actions

• No specific blocking actions recommended due to low-risk classification
• Standard monitoring applies; traffic patterns consistent with legitimate Google Cloud infrastructure
• No firewall rules required based on current risk profile

## Intelligence Conclusion

The IP 136.111.21.196/32 operates as a legitimate Google Cloud web server endpoint. Technical indicators—including Kubernetes certificate associations, Google Cloud infrastructure classification, and absence of threat indicators—confirm benign cloud infrastructure usage. No immediate defensive action required. Standard SOC monitoring recommended.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.