35.196.36.160
# IP INTELLIGENCE BRIEFING
Target: 35.196.36.160/32
Classification: LOW RISK / GOOGLE CLOUD INFRASTRUCTURE
Date: Current Intelligence Cycle
---
## EXECUTIVE SUMMARY
IP 35.196.36.160 is a Google Cloud infrastructure address with low-risk profile (Risk Score: 25). The IP is part of the GOOGLE-CLOUD network (ASN 396982, CIDR 35.192.0.0/12) and resolves to a Google Usercontent endpoint. No active threat indicators or malicious activity observed.
---
## OWNERSHIP & INFRASTRUCTURE
| Attribute | Value |
|---|---|
| Organization | Google LLC |
| ASN | 396982 |
| Network | GOOGLE-CLOUD |
| CIDR Block | 35.192.0.0/12 |
| Geographic Location | Moncks Corner, SC, US |
| Timezone | America/New_York |
DNS Resolution: 160.36.196.35.bc.googleusercontent.com
Email Authentication: SPF and DMARC records present on associated domain
---
## RISK PROFILE
| Metric | Value |
|---|---|
| Risk Score | 25 (Low) |
| Abuse Confidence | Not Applicable |
| Threat Feed Matches | 0 |
| Blacklist Count | 0 |
| Tor Exit Node | No |
| Known Attacker | No |
| Spam Source | No |
Control Plane:
- BGP Prefix: 35.196.32.0/20
- Route Stability: Unstable
- DNSBL Listed: 1 of 8 total lists
- RPKI State: Not validated
- Operator Score: 0.3478 (Basic)
---
## NETWORK SERVICES & EXPOSURE
| Service | Status |
|---|---|
| Open Ports | None detected |
| TLS Certificate | Not exposed |
| HTTP Banner | Not exposed |
| Server Type | Firewalled / No Services |
| Infrastructure Type | Cloud (Google Cloud) |
Assessment: The IP is not publicly accessible and appears to be firewalled with no open services.
---
## NEIGHBORHOOD ANALYSIS
Subnet: 35.196.36.160/24
Abuse Density: 0 (Clean)
Threat Siblings: 0
Total Siblings: 1
Risk Classification: Clean
The /24 subnet shows no evidence of abuse or malicious activity. No neighboring IPs flagged for threat.
---
## OBSERVATION HISTORY
Total Observations: 21
Key Findings:
- Ownership has remained stable with no changes detected
- No persistent malicious activity observed
- Recent scans show no open ports or exposed services
- Threat persistence days: 0
- No known campaigns correlated
---
## RELATIONSHIP GRAPH
Associated Entities:
- DNS Hostname: 160.36.196.35.bc.googleusercontent.com (multiple associations)
- Network: GOOGLE-CLOUD (same network)
- No additional organizational or certificate associations detected
---
## THREAT INDICATORS
| Indicator | Status |
|---|---|
| Known Malware | No |
| C2 Server | No |
| Spam Source | No |
| Phishing Infrastructure | No |
| Campaign Membership | None |
---
## RECOMMENDATIONS FOR SOC ANALYSTS
1. No action required for defensive purposes - IP is Google Cloud infrastructure with no threat indicators
2. Allow traffic through security controls if it matches legitimate business needs (Google Cloud services)
3. Monitor for any changes in DNS resolution or service exposure if this IP appears in security events
4. Contextualize any alerts against this IP as likely false positives related to legitimate Google Cloud operations
5. Update allowlists if necessary for expected Google Cloud traffic patterns
---
## CONFIDENCE LEVEL
High – Based on comprehensive profile analysis, historical data, and neighborhood assessment. The IP represents legitimate Google Cloud infrastructure with no observable malicious activity.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Google LLC |
| ASN | AS396982 |
| Network Name | GOOGLE-CLOUD |
| CIDR Block | 35.192.0.0/12 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 160.36.196.35.bc.googleusercontent.com |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | 160.36.196.35.bc.googleusercontent.com |
🔐 DNS Hygiene
| Hygiene Score | 100% (Excellent) |
| SPF | Present |
| DMARC | Present |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Present |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 30% | 2 | 3 |
| routing | 13% | 1 | 1 |
| services | 19% | 2 | 2 |
| ownership | 27% | 2 | 3 |
| reputation | 15% | 1 | 2 |
| geolocation | 35% | 2 | 3 |
| Overall | 23% | 10 | 14 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (70%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-07-21 12:55:28 UTC |
| Last Seen | 2026-08-12 16:01:23 UTC |
| Profile Built | 2026-08-12 16:07:32 UTC |
| Data Freshness | Live |
| Signal Types | 23 |
| Total Observations | 25 |
Full dossier details are available via our API.