35.231.130.249📋 Copy

IP INTELLIGENCE BRIEFING: 35.231.130.249/32

Classification: Moderate Risk (Score: 40) | Infrastructure Type: Cloud Compute (Google Cloud)

Ownership & Network Context:

The IP address belongs to Google LLC (ASN 396982) within the GOOGLE-CLOUD network block 35.208.0.0/12. The address resolves to PTR hostname 249.130.231.35.bc.googleusercontent.com and is classified as a cloud hosting infrastructure resource. Geolocation data places the endpoint in Moncks Corner, South Carolina, US (coordinates: 33.21, -80.17), though ICMP validation was blocked during probing.

Threat Assessment:

• Overall risk score: 40 (moderate)
• No known attacker indicators, Tor exit node, or spam source activity
• No active threat feeds or known campaign matches
• DNSBL listing: 2 of 8 total blacklists
• Control plane stability flagged as non-stable with no route changes in 30 days

Historical Observations:

Analysis of 19 signal observations reveals:

• Recent scanning activity detected on 2026-08-13
• No persistent malicious activity recorded
• Subnet abuse density classified as "clean" (0 abuse density)
• No observed changes in geolocation or DNS records over the observation period
• No evidence of evolving threat posture

Network Relationships & Neighborhood:

• DNS associations link to 249.130.231.35.bc.googleusercontent.com
• No external organization or certificate relationships identified
• Subnet 35.231.130.249/24: 0 active sibling IPs, 0 threat siblings, 0 abuse density
• No neighboring IPs detected in the local /24 block

Recommended Actions:

The IPDebrief actions module generated probabilistic firewall rules for deployment across multiple platforms:

• iptables: `iptables -A INPUT -s 35.231.130.249 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 35.231.130.249 drop`
• Cloudflare WAF: Block with expression `ip.src eq 35.231.130.249`
• AWS WAF: Add `35.231.130.249/32` to block rule set

Assessment Summary:

This IP operates within legitimate Google Cloud infrastructure with no active threat indicators. The moderate risk score (40) reflects limited DNSBL presence rather than confirmed malicious behavior. However, given the IP's classification as cloud hosting infrastructure, SOC teams should monitor for anomalous traffic patterns. The absence of open ports and services suggests the endpoint is firewalled or idle. No immediate blocking is recommended absent additional correlation with threat intelligence alerts or observed malicious traffic from this address.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.