35.187.204.165📋 Copy

# IP Intelligence Briefing: 35.187.204.165/32

Classification: Cloud Infrastructure – Legitimate Google Cloud Service

Risk Level: Moderate (Score: 50)

Date: Intelligence compiled from IPDebrief analysis

---

## Executive Summary

IP address 35.187.204.165 is identified as a Google Cloud infrastructure endpoint operating from Tokyo, Japan. The IP demonstrates no malicious indicators despite a moderate risk classification driven primarily by DNSBL listings. No open services or active threat behaviors observed. Recommended action: Monitor; no blocking required.

---

## Ownership & Infrastructure

Control Plane Analysis:

• Origin ASN: 396982
• BGP Prefix: 35.187.192.0/20
• Route Stability: False
• DNSSEC Valid: Yes
• DNSBL Status: Listed on 2 of 8 total blacklists
• Operator Score: 0.3478 (Basic)

---

## Geolocation

Note: Geographic validation shows inconsistency (geo_plausible: false) with a distance variance of 9,212 km from expected location. This may indicate proxy usage or routing anomalies.

---

## Threat Assessment

Threat Indicators: None detected

• Known Attacker: False
• Spam Source: False
• Tor Exit Node: False
• Blacklist Count: 0 (despite 2 DNSBL listings)
• Known Campaigns: None
• Threat Feeds: Empty

Risk Breakdown:

• Risk Score: 50 (Moderate)
• Provider Score: 0
• Authority Score: 0
• Stability Score: 0
• Abuse Confidence: N/A

---

## Network Behavior & Services

DNS Configuration:

• PTR Hostname: 165.204.187.35.bc.googleusercontent.com
• Forward Resolution: Confirmed (1 record)
• Forward Hostname: 165.204.187.35.bc.googleusercontent.com
• SPF: Present
• DMARC: Present
• TXT Records: 0

---

## Historical Observation Summary

Total Observations: 14 signals

Recent Activity (2026-08-06):

• 03:08:36 UTC: Geo probe (hop count: N/A, avg RTT: 175ms, jitter: 5.06ms)
• 03:07:56 UTC: Geolocation signal (Tokyo, Tokyo, Japan)
• 03:07:23 UTC: Organization registration (Google LLC, ARIN)
• 03:07:23 UTC: Network registration (ASN: N/A, CIDR: 35.184.0.0/13, US postal code: 94043)
• 03:06:27 UTC: Operator score assessment (Basic, score: 0.3478)

Temporal Indicators:

• Ownership Changes: 0
• Threat Persistence Days: 0
• Threat Observation Count: 0
• Persistently Malicious: False

---

## Relationship Graph

Note: Duplicate DNS entry indicates potential redundancy or load balancing configuration.

---

## Subnet Neighborhood Analysis

• Subnet: 35.187.204.165/24
• Neighbor Count: 0
• Abuse Density: 0
• High Risk Neighbors: 0
• Medium Risk Neighbors: 0
• Low Risk Neighbors: 0
• Threat Siblings: 0
• Active Siblings: 0

Assessment: No adjacent IPs within the /24 subnet exhibit threat characteristics.

---

## Recommended Actions

Based on the risk profile and observed behavior:

Firewall Recommendations:

• No blocking rules required
• Consider geo-validation rules if strict location enforcement is needed
• Monitor for service enumeration attempts (no services currently exposed)

---

## Conclusion

IP 35.187.204.165 represents legitimate Google Cloud infrastructure with a moderate risk classification primarily driven by DNSBL listings rather than active malicious behavior. The IP shows no signs of exploitation, command-and-control activity, or anomalous network behavior. The geographic validation anomaly warrants monitoring but does not independently indicate compromise. SOC analysts may treat this IP as trusted infrastructure with routine monitoring protocols.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.