136.85.75.94📋 Copy

IP INTELLIGENCE BRIEFING: 136.85.75.94/32

OVERVIEW

IP address 136.85.75.94 is assigned to Google Cloud Platform (ASN 396982) with a moderate risk score of 40. The address resolves to googleusercontent.com and is classified as a single-service host with SSH (port 22) open.

INFRASTRUCTURE PROFILE

• Provider: Google Cloud Platform
• Organization: Google LLC, US (via team-cymru-dns)
• ASN: 396982
• BGP Prefix: 136.85.0.0/17
• Network Classification: Single-Service Host
• DNS: 94.75.85.136.bc.googleusercontent.com (forward confirmed)
• Open Services: TCP/22 (SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18)

GEOGRAPHIC INDICATORS

• Country: Singapore (SG)
• Geolocation Confidence: Plausible (1 source, consensus: true)
• RTT Metrics: Min 241ms, Avg 245.4ms, Max 251ms
• Distance: 7625.7 km from probe origin

THREAT ASSESSMENT

• Risk Score: 40 (Moderate Risk)
• Abuse Confidence: Null
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Campaign Indicators: No known campaigns, zero correlated IPs
• Persistence: Not persistently malicious (threatPersistenceDays: 0)
• Known Attacker/Spam/Tor: No matches

NEIGHBORHOOD ANALYSIS

Subnet 136.85.75.0/24 classified as clean with zero abuse density. No sibling IPs flagged as threats. Inherited risk score: 0.

OBSERVATION HISTORY

14 signal observations recorded. Recent activity shows consistent geolocation data, DNSSEC validation (valid), and control plane stability. No escalating threat patterns observed.

RECOMMENDED ACTIONS

IMMEDIATE:

• Block at perimeter: `iptables -A INPUT -s 136.85.75.94 -j DROP`
• Cloudflare WAF: Block with expression `ip.src eq 136.85.75.94`
• AWS WAF: Add 136.85.75.94/32 to blocked addresses

NOTES FOR SOC ANALYSTS:

This is a Google Cloud Platform infrastructure IP with moderate risk scoring primarily from DNSBL listings (2 of 8). The low neighborhood abuse density and lack of threat indicators suggest this may be a legitimate cloud host with minor reputation issues. Consider blocking if this IP appears in inbound threat logs, but weigh against the probability of legitimate Google Cloud traffic.

CONFIDENCE LEVEL: Moderate – Risk score driven by DNSBL presence rather than active threat indicators. Monitor for correlation with other threat signals.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.