35.203.211.12📋 Copy

# IP Intelligence Briefing: 35.203.211.12/32

## Executive Summary

The IP address 35.203.211.12 presents a moderate risk profile (score: 50) with no active threat indicators. The address is associated with Google Cloud infrastructure in the US. No malicious activity, blacklist listings, or known campaigns were observed.

## Ownership and Infrastructure

• Organization: Google LLC (ASN 396982)
• Network: GOOGLE-CLOUD, 35.192.0.0/12
• Geolocation: New York, US (US-NY)
• RIR: ARIN
• DNS: 12.211.203.35.bc.googleusercontent.com (googleusercontent.com)

The IP resolves to Google's cloud infrastructure with proper DNS configuration including SPF and DMARC records. The address shows forward resolution confirmation and is classified as firewalled with no open services.

## Threat Assessment

• Risk Score: 50 (Moderate Risk)
• Abuse Confidence: None observed
• Blacklist Count: 0
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Active Threat Indicators: None

The control plane data indicates the IP is listed on 2 of 8 threat feeds (DNSBL), though no active abuse indicators were detected. The address shows no evidence of persistent malicious behavior.

## Network Neighborhood Analysis

The /24 subnet (35.203.211.0/24) contains 53 sibling IPs with an abuse density of 0. Risk distribution shows:

• High Risk: 0 IPs
• Medium Risk: 8 IPs
• Low Risk: 45 IPs

Sample neighbors exhibit risk scores between 25-40 with authority scores of 90, indicating legitimate cloud infrastructure usage.

## Historical Observations

Fourteen signal observations recorded, with the most recent activity on 2026-07-05. Historical data shows consistent ownership attribution to Google LLC with confidence levels ranging from 0.60 to 0.95. No significant changes in geolocation, ownership, or threat indicators were observed.

## Recommended Actions

Given the moderate risk classification with no active threat indicators, standard monitoring is recommended. No immediate blocking or firewall rules are warranted. The IP should be allowed through with standard cloud provider policies in place.

---

Classification: Standard Cloud Infrastructure

Recommendation: Monitor, No Action Required

Analyst Notes: Legitimate Google Cloud endpoint with no malicious indicators detected.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.