35.201.138.6📋 Copy

# INTELLIGENCE BRIEFING: 35.201.138.6

## Executive Summary

IP 35.201.138.6 is a Google Cloud infrastructure endpoint located in Taipei, Taiwan with moderate overall risk scoring but no active malicious indicators. The IP is classified as cloud infrastructure with firewalled status and no exposed services.

## Ownership & Infrastructure

• Organization: Google LLC
• ASN: 396982 (GOOGLE-CLOUD)
• CIDR Block: 35.192.0.0/12
• Network Role: Google Cloud Provider
• Infrastructure Type: Unknown services (firewalled)

## Geolocation

• Country: Taiwan (TW)
• City: Taipei
• Validation: ICMP blocked—unable to validate geolocation via probes
• Distance: 9,348.8 km from reference point

## Threat Assessment

• Risk Score: 50 (Moderate Risk)
• Abuse Confidence: Null
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Known Threats: None detected
• Tor Exit: No
• Known Attacker: No
• Spam Source: No

## Network Characteristics

• Open Ports: None detected
• DNS Resolution: 6.138.201.35.bc.googleusercontent.com
• Domain: googleusercontent.com
• Forward Confirmed: Yes
• Service Purpose: Firewalled / No Services

## Control Plane & Routing

• BGP Prefix: 35.201.128.0/20
• Route Stability: Unstable (isRouteStable: false)
• RPKI State: Not validated
• DNSSEC: Valid
• Operator Score: 0.3478 (Basic)

## Neighborhood Analysis

• Subnet: 35.201.138.6/24
• Abuse Density: 0 (Clean)
• Threat Siblings: 0
• Active Siblings: 0
• Total Siblings: 1

## Historical Observations

Recent signal history (July–August 2026) shows consistent basic-level classification signals with no escalation. Threat observation count remains at zero, and the IP is not flagged as persistently malicious.

## Related Entities

• DNS Associations: Multiple entries pointing to 6.138.201.35.bc.googleusercontent.com
• Network Associations: Same Network (GOOGLE-CLOUD)

## Recommended Actions

Based on the moderate risk classification and DNSBL listings:

• Monitor for changes in route stability
• Verify DNSBL listing contexts before blocking
• No immediate blocking recommended due to Google Cloud infrastructure classification and lack of active threat indicators
• Consider allowlisting if used for legitimate services

## Conclusion

This IP represents Google Cloud infrastructure with no currently active malicious activity. The moderate risk score appears attributable to DNSBL listings rather than confirmed threat indicators. SOC teams may monitor for route stability changes but should not block without additional context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.