35.197.212.20📋 Copy

# IP Intelligence Briefing: 35.197.212.20/32

## Executive Summary

IP 35.197.212.20 is a Google Cloud infrastructure asset with a moderate risk score of 50. The IP hosts RDP service (port 3389) and is associated with the googleusercontent.com domain. While the broader subnet shows clean abuse density, the single-service host configuration with exposed remote desktop protocols warrants monitoring.

## Infrastructure Profile

• Organization: Google LLC (GOOGLE-CLOUD)
• ASN: AS396982
• CIDR Block: 35.192.0.0/12
• Geolocation: England, City of London, GB
• Network Classification: Single-Service Host
• Control Plane Status: Route unstable, DNSSEC valid, CAA records present

## Security Posture

• Risk Score: 50 (Moderate Risk)
• Abuse Confidence: Not flagged as known attacker, spam source, or Tor exit
• Blacklist Status: 0 active blacklists
• DNSBL Listed: 2 of 8 total lists

## Service Exposure

• Port 3389 (RDP/tcp): Open with no banner detected
• TLS Certificate: Not detected
• HTTP Services: Not detected
• Email Auth: SPF and DMARC configured for googleusercontent.com

## Relationship Mapping

• DNS Association: 20.212.197.35.bc.googleusercontent.com
• Network Association: GOOGLE-CLOUD infrastructure
• Related Entities: 12 relationship links (primarily DNS and network associations)

## Neighborhood Analysis

• Subnet: 35.197.212.0/24
• Abuse Density: 0.0 (clean)
• Threat Siblings: 0
• Classification: Clean subnet with minimal threat indicators

## Historical Observations

Analysis of 20 signal observations indicates:

• Consistent geolocation reporting from London, GB
• No ownership changes detected
• No persistent threat activity
• Recent scans show standard port enumeration activity
• Stability score indicates normal infrastructure behavior

## Recommended Security Actions

Given the moderate risk score and RDP exposure, the following firewall rules are recommended:

Firewall Blocking Rules:

• iptables: `iptables -A INPUT -s 35.197.212.20 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 35.197.212.20 drop`
• nginx: `deny 35.197.212.20;`
• pfSense: `35.197.212.20/32`
• Cloudflare WAF: Block IP with description "IPDebrief risk score 50"
• AWS WAF: Add `35.197.212.20/32` to deny list

## Analyst Notes

While the IP is part of Google Cloud infrastructure, the open RDP port (3389) represents an unusual service exposure for cloud infrastructure. The moderate risk score is primarily driven by the DNSBL listings and RDP exposure. The clean subnet classification suggests this is an isolated finding rather than part of a coordinated campaign. SOC teams should monitor for RDP brute force attempts from this IP and verify whether the RDP service is legitimately required for this host.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.