35.203.210.212📋 Copy

# IP Intelligence Briefing: 35.203.210.212/32

## Executive Summary

IP address 35.203.210.212 is a Google Cloud infrastructure endpoint located in London, GB. The IP carries a moderate risk score of 40 with a high-abuse density classification (0.641) in its /24 subnet. Despite being part of Google Cloud's infrastructure, the subnet exhibits elevated abuse activity with 25 of 39 sibling IPs flagged as threats. No direct threat indicators or blacklist listings were identified for this specific IP.

## Infrastructure Profile

• Organization: Google LLC (GOOGLE-CLOUD)
• ASN: 396982
• CIDR Block: 35.192.0.0/12
• Geolocation: London, England, GB (51.51°N, -0.13°W)
• DNS Resolution: 212.210.203.35.bc.googleusercontent.com
• Service Status: Firewalled / No Services Open
• Network Role: Cloud Infrastructure (Google Cloud)

## Risk Assessment

Key Observations:

• No known attacker patterns, Tor exit nodes, or spam source indicators
• No active threat campaigns or certificate-based threat matches
• DNSSEC valid with CAA records present
• Route stability flag indicates potential routing changes in last 30 days

## Neighborhood Analysis (35.203.210.0/24)

The /24 subnet contains 39 total IPs with 25 active siblings and 25 threat siblings:

• Abuse Density: 0.641 (high_abuse classification)
• Risk Distribution: 0 High-risk, 12 Medium-risk, 30 Low-risk neighbors
• Inherited Risk: 25 (moderate from subnet context)
• Notable Pattern: Most neighbors show authority scores of 90, indicating legitimate Google Cloud usage, but 25 IPs share threat indicators

The elevated neighborhood abuse density suggests this subnet may be hosting compromised instances or experiencing abuse from other tenants.

## Relationship Graph

• DNS Associations: Multiple references to 212.210.203.35.bc.googleusercontent.com
• Network Affiliations: GOOGLE-CLOUD (repeated associations)
• Control Plane: Origin ASN 396982 with BGP prefix 35.203.210.0/24

## Observation History

Analysis of 19 signal observations reveals consistent patterns:

• Recent observations (June 16, 2026) show stable high_abuse classification
• Geographic consistency maintained across observations (London, GB)
• No evidence of persistent malicious behavior or ownership changes
• Operator score remains at 0.3478 (Basic level)

## Recommended Actions

Immediate Mitigation Measures:

1. Network Filtering:

```bash

iptables -A INPUT -s 35.203.210.212 -j DROP

nft add rule inet filter input ip saddr 35.203.210.212 drop

```

2. Application-Level Blocking:

```nginx

deny 35.203.210.212;

```

3. Cloud Provider Integration:

- Cloudflare WAF: Block IP with expression `ip.src eq 35.203.210.212`

- AWS WAF: Add address `35.203.210.212/32` to rule group

4. Security Context:

- Action is probabilistic and should be combined with additional threat signals

- Monitor for similar IPs from the 35.203.210.0/24 subnet

- Evaluate if traffic patterns align with legitimate Google Cloud service usage

## Intelligence Context

This IP represents legitimate Google Cloud infrastructure but operates within a high-abuse subnet. The moderate risk score (40) and high abuse density warrant monitoring but do not indicate confirmed malicious activity. Defense-in-depth measures should include subnet-level filtering for the 35.203.210.0/24 range if business context permits, particularly given 25 sibling IPs with threat indicators.

Classification: Moderate Risk - Monitor with Filtering

Threat Level: 4/10

Recommended Action: Block with logging for forensic analysis

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.