35.209.43.176📋 Copy

## IP Intelligence Briefing: 35.209.43.176/32

Classification: Google Cloud Infrastructure | Risk Level: Moderate (Score: 50/100) | Date: Current

---

Executive Summary

IP 35.209.43.176 is an infrastructure address associated with Google LLC's GOOGLE-CLOUD network (35.208.0.0/12). While classified as a legitimate cloud provider, the address exhibits anomalous characteristics including an open RDP port (3389) and geolocation inconsistencies. No active threat indicators or malicious campaigns were identified.

---

Ownership & Classification

• Organization: Google LLC
• Network Name: GOOGLE-CLOUD
• CIDR Block: 35.208.0.0/12
• Network Role: Single-Service Host (Google Cloud infrastructure)
• DNS Domain: googleusercontent.com
• PTR Hostname: 176.43.209.35.bc.googleusercontent.com

---

Threat Indicators & Risk Assessment

• Risk Score: 50/100 (Moderate Risk)
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Known Threats: None

- Not identified as Tor exit node

- Not flagged as known attacker or spam source

- No known campaign associations

• Abuse Confidence: Score unavailable
• Control Plane: DNSSEC valid, CAA records present, route stability: false

---

Network Services & Vulnerabilities

Open Ports Detected:

• Port 3389/TCP (RDP): Active — Remote Desktop Protocol exposure on cloud infrastructure

Services Assessment:

• TLS Certificate: None detected
• HTTP Title: None detected
• Email Authentication: SPF and DMARC records configured

---

Geolocation Analysis

• Claimed Location: Council Bluffs, IA, US (41.88°N, -93.10°W)
• Geolocation Validity: INVALID
• RTT Violation: Measured RTT 63.0ms is less than minimum possible 144.4ms required for 7,219km distance
• Validation Status: GeoPlausible: false (5 probes)

---

Observation History

Recent signal activity (July 2026):

• Network connectivity and traceroute observations completed
• Port scanning activity detected (multiple ports probed)
• No persistent malicious behavior observed
• Ownership stability: No changes recorded
• Threat persistence: 0 days observed

---

Relationship Graph

• DNS Associations: Multiple records to 176.43.209.35.bc.googleusercontent.com
• Network Affiliations: GOOGLE-CLOUD (same network)
• Related Entities: 5 total relationships identified

---

Neighborhood Analysis

• Subnet: 35.209.43.176/24
• Neighbor Count: 0 (no sibling IPs in subnet)
• Abuse Density: 0 (no elevated risk in neighborhood)
• Risk Distribution: No high/medium/low risk neighbors detected

---

Recommended Actions

For SOC Operations:

1. Monitor RDP Exposure: Port 3389 is open on Google Cloud infrastructure. Verify this is intentional (e.g., jump host or legacy application) and ensure it's properly secured.

2. Geolocation Discrepancy: Investigate why geolocation data is implausible. This may indicate misconfiguration, spoofing, or CDN edge routing.

3. DNSBL Monitoring: Address listing on 2 DNSBLs. Determine if these are false positives or require remediation.

4. Baseline Behavior: Establish normal traffic patterns for this IP. The moderate risk score warrants continued monitoring despite cloud provider association.

For Network Defense:

• No immediate blocking required. The IP is classified as legitimate cloud infrastructure.
• Consider rate limiting or geographic restrictions if RDP access is unexpected.

---

Conclusion: IP 35.209.43.176 represents Google Cloud infrastructure with anomalous RDP exposure and geolocation inconsistencies. No active threat indicators present. Monitor for escalation in risk score or additional malicious activity.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.