35.233.170.197📋 Copy

IP INTELLIGENCE BRIEFING: 35.233.170.197/32

Classification: Moderate Risk | Provider: Google Cloud Platform

Date: 2026-08-06

Risk Score: 40/100

---

**EXECUTIVE SUMMARY**

IP 35.233.170.197 is a Google Cloud infrastructure address (ASN 396982) located in The Dalles, Oregon, United States. The IP exhibits moderate risk characteristics with 0 blacklists and no known threat indicators, though it is listed on 2 of 8 DNSBL feeds. The address shows stable ownership history with no persistent malicious activity detected.

---

**OWNERSHIP & GEOLOCATION**

Geolocation data validated with consensus across multiple sources. Forward DNS resolves to: 197.170.233.35.bc.googleusercontent.com

---

**THREAT ANALYSIS**

Risk Indicators:

• Risk Score: 40 (Moderate)
• Abuse Confidence: Null
• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

Control Plane:

• Origin ASN: 396982
• BGP Prefix: 35.233.128.0/17
• DNSBL Listed: 2/8 lists
• Operator Score: 0.3478 (Basic)
• Route Stability: False

---

**NETWORK BEHAVIOR**

Services & Ports:

• Open Ports: None detected
• TLS Certificate: None
• HTTP Banner: None
• Infrastructure Type: Cloud infrastructure

Neighborhood Analysis (35.233.170.0/24):

• Abuse Density: 0.5 (moderate)
• Classification: Mostly clean
• Active Siblings: 1 (35.233.170.211, risk score 25)
• Threat Siblings: 1

---

**OBSERVATION HISTORY**

19 total observations recorded. Most recent activity on 2026-08-06 showing:

• Ownership stable (0 changes)
• No persistent malicious activity
• ICMP validation blocked
• 8032.6km distance from validation point

---

**RECOMMENDED ACTIONS**

Firewall Rules:

```

iptables: iptables -A INPUT -s 35.233.170.197 -j DROP

nftables: nft add rule inet filter input ip saddr 35.233.170.197 drop

nginx: deny 35.233.170.197;

pfSense: 35.233.170.197/32

Cloudflare WAF: Block IP 35.233.170.197 (risk score 40)

AWS WAF: Address: 35.233.170.197/32

```

---

**ANALYST NOTES**

The IP is associated with legitimate Google Cloud infrastructure but exhibits moderate risk characteristics. The neighborhood shows elevated abuse density with one active sibling (35.233.170.211) and one threat sibling. Given the cloud hosting context and moderate risk score, analysts should:

1. Monitor for unusual traffic patterns from this subnet

2. Review connection logs for anomalous behavior

3. Consider blocking at perimeter if legitimate traffic not expected

4. Verify DNSBL listings to understand blocking context

Threat Likelihood: None | Campaign Correlation: 0 correlated IPs

---

*Report generated from IPDebrief intelligence data. Verify before implementing blocking rules.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.