35.221.5.154📋 Copy

## IP Intelligence Briefing: 35.221.5.154

Subject: Google Cloud Infrastructure IP Analysis

Date: 2026-08-13

Risk Classification: Moderate Risk (Score: 40/100)

Infrastructure Provider: Google Cloud Platform (GOOGLE-CLOUD)

---

Ownership and Network Classification

The target IP 35.221.5.154 is registered to Google LLC, operating within the GOOGLE-CLOUD network infrastructure (ASN: 396982). The IP resides in the 35.208.0.0/12 CIDR block, classified as cloud compute infrastructure with hosting capabilities. The IP resolves to the googleusercontent.com domain via reverse DNS (154.5.221.35.bc.googleusercontent.com).

Geolocation and Technical Findings

Geolocation data indicates Ashburn, VA, US (39.04, -77.49), though validation flags show discrepancies: Round-trip time measurements (25-42ms) contradict the claimed geographic distance of 6,296km, suggesting potential proxying or measurement anomalies. The IP is not classified as Tor, proxy, or residential infrastructure.

Network Services and Scanning Activity

Active service scanning identified SSH on port 22 (OpenSSH 8.9p1 Ubuntu-3ubuntu0.16). The IP shows no TLS certificate or HTTP service exposure. Control plane analysis indicates the IP is not route-stable and is not listed as a MOAS (Multiple Origin Autonomous System) resource.

Threat Intelligence Indicators

The IP appears on 2 DNSBL listings out of 8 lists scanned, with maximum severity rated as high. Abuse confidence score data unavailable. No known attacker attribution, campaign associations, or threat feed matches. Historical analysis reveals 19 observations over the monitored period.

Neighborhood Analysis

The /24 subnet (35.221.5.0/24) demonstrates low abuse density with zero high-risk neighbors. One sibling IP (35.221.5.170) registers a risk score of 25 with authority score of 90. Overall subnet threat indicators remain benign.

Relationship Graph

The IP maintains associations with:

• GOOGLE-CLOUD network (multiple entries)
• Hostname: 154.5.221.35.bc.googleusercontent.com

Historical Trend Analysis

Observation history indicates recent activity dated 2026-08-13. Multiple signals captured include:

• Geolocation inference (56% confidence)
• DNS resolution confirmation (80% confidence)
• DNSBL listing events (85% confidence, high severity)

No persistent malicious behavior observed over the monitoring window.

Recommended Actions

Based on the moderate risk profile and cloud infrastructure classification:

1. Monitor DNSBL listing status for potential abuse correlation

2. Verify SSH access requirements if this IP is whitelisted

3. Continue observation of geolocation validation discrepancies

4. No immediate firewall action required; IP remains within expected cloud provider parameters

---

Analyst Notes: This IP represents legitimate Google Cloud infrastructure with minor threat indicator listings. The moderate risk score (40) primarily reflects DNSBL associations rather than confirmed malicious activity. SOC teams may monitor for correlation with other flagged IPs from the same cloud infrastructure block.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.