35.203.211.139📋 Copy

# IP Intelligence Briefing: 35.203.211.139/32

## Executive Summary

IP 35.203.211.139 is a Google Cloud infrastructure address with a moderate risk score of 40. The IP is located in London, England, operating within the GOOGLE-CLOUD network (AS396982, 35.192.0.0/12). While the IP itself shows no direct threat indicators, the surrounding /24 subnet exhibits elevated abuse characteristics that warrant monitoring.

## Infrastructure Profile

• Organization: Google LLC
• ASN: 396982 (GOOGLE-CLOUD)
• Geolocation: London, ENG, GB
• Service Classification: CloudCompute, Firewalled/No Services
• DNS: Resolves to 139.211.203.35.bc.googleusercontent.com
• Email Authentication: SPF and DMARC configured
• Network Role: Cloud hosting infrastructure with no publicly accessible services

## Risk Assessment

## Neighborhood Analysis (35.203.211.0/24)

The /24 subnet contains 46 sibling IPs with concerning characteristics:

• Abuse Density: 0.5682 (classified as high_abuse)
• Threat Siblings: 25 out of 44 active siblings
• Inherited Risk Score: 22
• Risk Distribution: 0 high-risk, 16 medium-risk, 30 low-risk neighbors

Multiple neighboring IPs (including 35.203.211.4, 35.203.211.13, 35.203.211.34, 35.203.211.41, 35.203.211.67, 35.203.211.82, 35.203.211.108, 35.203.211.109, 35.203.211.135, 35.203.211.151, 35.203.211.165, 35.203.211.177, 35.203.211.199, 35.203.211.209, 35.203.211.215, 35.203.211.236, 35.203.211.245, 35.203.211.253) share the same riskScore of 40.

## Observation History

24 observations recorded. Recent signals include:

• Subnet abuse classification (high_abuse) with 25 threat siblings
• AlienVault OTX geolocation data indicating threats present (50 pulses)
• Operator scoring at 0.3478 (Basic classification)
• One signal flagged with "has_threats": true

## Relationships

All 18 identified relationships are internal:

• Multiple "Same Network" entries to GOOGLE-CLOUD
• DNS associations to 139.211.203.35.bc.googleusercontent.com
• No external organization or certificate relationships detected

## Recommended Actions

No specific action recommendations generated. However, based on the risk profile and neighborhood context, the following firewall rules may be considered:

```

iptables -A INPUT -s 35.203.211.139 -j DROP

nft add rule inet filter input ip saddr 35.203.211.139 drop

```

## Intelligence Assessment

This IP represents legitimate Google Cloud infrastructure but operates within a subnet showing elevated abuse characteristics. The moderate risk score (40) combined with the high abuse density of the /24 subnet suggests this IP could be co-located with or adjacent to malicious activity. While the IP itself is not directly flagged as malicious, the neighborhood context warrants continued monitoring.

Recommendation: Monitor for anomalous activity patterns. Consider blocking if traffic exhibits suspicious behavior, given the subnet's elevated abuse profile.

---

*Report generated: 2026-06-16 | Source: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.