35.228.181.105📋 Copy

# INTELLIGENCE BRIEFING: 35.228.181.105/32

Classification: LOW RISK

Report Date: Current

Risk Score: 25/100

Provider: Google Cloud (ASN 396982)

---

## EXECUTIVE SUMMARY

IP address 35.228.181.105 is a Google Cloud infrastructure endpoint with a low-risk profile (25/100). No active threat indicators, malicious campaigns, or abuse patterns have been identified. The IP resolves to Google Cloud Storage/CDN infrastructure (googleusercontent.com) with no open services detected.

---

## OWNERSHIP & INFRASTRUCTURE

The IP is part of Google's cloud network infrastructure (35.228.176.0/20 BGP prefix) and operates within the Google Cloud provider ecosystem.

---

## GEOLOCATION ANALYSIS

Primary Location: Finland (FI) - South Karelia Region, Lappeenranta

Geolocation Consensus: True

Multiple Sources: 2 geolocation sources confirm Finland placement

NOTABLE DISCREPANCY: Historical traceroute observations indicate transit through Comcast networks with geo-signals pointing to New York, US. This discrepancy may reflect routing path variations rather than endpoint location. The primary geolocation consensus remains Finland with 2500km accuracy radius.

RTT Measurements: Average 127.6ms, Minimum 124ms, Maximum 134ms

---

## DNS & RESOLVING INFRASTRUCTURE

DNS resolution is properly configured with SPF and DMARC authentication. The hostname indicates association with Google Cloud Storage/CDN services.

---

## THREAT INTELLIGENCE

Threat Indicators: None detected

Known Campaigns: None

Blacklist Count: 0

Tor Exit Node: No

Known Attacker: No

Spam Source: No

Abuse Confidence Score: Not calculated

DNSBL Status: Listed on 1 of 8 total DNSBL lists

Threat Persistence: Not persistently malicious

Threat Observation Count: 0

---

## NETWORK SERVICES & PORTS

No active services or open ports were detected during service probing. The IP appears to be configured as a firewalled/no-services endpoint.

---

## OBSERVATION HISTORY

Total Observations: 19

Recent Activity: Observed on 2026-08-06 (19 total signals)

Key Historical Signals:

• Geo-location signals: New York, US (Comcast transit) and Finland coordinates
• Average ownership days: Not calculated
• Threat persistence days: 0
• Ownership changes: 0
• Route stability: False

The IP shows minimal signal persistence and no evidence of evolving threat behavior.

---

## RELATIONSHIP GRAPH

Total Relationships: 9

All relationships indicate association with Google Cloud infrastructure and the googleusercontent.com hostname.

---

## NEIGHBORHOOD ANALYSIS

Subnet: 35.228.181.105/24

Neighbor Count: 0

Abuse Density: 0%

High Risk Neighbors: 0

Medium Risk Neighbors: 0

Low Risk Neighbors: 0

The /24 subnet shows no active sibling IP addresses and zero abuse density, indicating this is an isolated endpoint within its subnet range.

---

## CONTROL PLANE DATA

---

## RECOMMENDED ACTIONS

Risk-Based Recommendation: MONITOR

Action Required: None

The IP presents a low-risk profile with no actionable threat indicators. Standard monitoring practices apply. No firewall rules or blocking recommendations are generated at this time.

---

## SOC ANALYST NOTES

1. Infrastructure Classification: Legitimate Google Cloud Storage/CDN endpoint (googleusercontent.com)

2. Risk Profile: Low risk score (25/100) with no active threat indicators

3. Geo Discrepancy: Note the Finland primary location vs. US transit path signals

4. DNSBL Presence: Single listing among 8 total lists warrants periodic review

5

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.