35.247.110.146📋 Copy

# IP Intelligence Briefing: 35.247.110.146/32

Classification: Moderate Risk | Organization: Google LLC (GOOGLE-CLOUD) | Date: 2026-07-31

## Executive Summary

IP address 35.247.110.146 belongs to Google Cloud Infrastructure (ASN 396982) within the 35.208.0.0/12 block. The IP carries a risk score of 50 (Moderate Risk) with no active threat indicators, though it appears on 2 of 8 DNS blacklists. The IP resolves to googleusercontent.com and is classified as firewalled with no open services detected. Neighborhood analysis of /24 subnet 35.247.110.0/24 indicates clean abuse density (0) with minimal sibling risk.

## Infrastructure Profile

## Threat Assessment

• Risk Score: 50/100 (Moderate)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Status: Listed on 2 of 8 DNSBLs
• Abuse Confidence Score: Not calculated
• Campaign Correlation: None detected

Threat Signals: No active threat indicators. The IP does not match known attack campaigns or threat feeds.

## Behavioral Analysis (Observation History)

Sixteen observations recorded. Key findings:

• Geolocation Signals: Consistent US location with 45.6°N, -121.19°W coordinates
• DNS Signals: Valid CAA records and DNSSEC validation confirmed
• Blacklist Activity: Signal ID 2344 indicates 2 blacklist listings with maximum severity of "high"
• ICMP Response: Blocked - unable to validate (typical for cloud infrastructure)

## Network Neighborhood

Subnet: 35.247.110.0/24

• Total Siblings: 2
• Active Siblings: 1
• Abuse Density: 0 (Clean)
• Sibling Risk Distribution: Low (1), Medium (0), High (0)
• Notable Neighbor: 35.247.110.24 (Risk Score: 25, Authority Score: 90)

## Recommended Security Actions

Due to DNS blacklist listings and moderate risk classification, the following blocking rules are recommended:

iptables:

```

iptables -A INPUT -s 35.247.110.146 -j DROP

```

nftables:

```

nft add rule inet filter input ip saddr 35.247.110.146 drop

```

nginx:

```

deny 35.247.110.146;

```

pfSense:

```

35.247.110.146/32

```

Cloudflare WAF:

```json

{

"description": "Block 35.247.110.146 — IPDebrief risk score 50",

"action": "block",

"filter": {

"expression": "ip.src eq 35.247.110.146"

}

}

```

AWS WAF:

```json

{

"Addresses": ["35.247.110.146/32"],

"Description": "IPDebrief risk 50"

}

```

## Intelligence Notes

1. Legitimate Cloud Infrastructure: This IP is part of Google Cloud's infrastructure. The moderate risk score and blacklist listings may result from shared infrastructure reputation rather than direct malicious activity.

2. DNS Blacklist Presence: Two DNS blacklist listings require investigation. Verify if listings are due to infrastructure-wide reputation or specific malicious activity from this IP.

3. No Active Services: The IP shows no open ports or services, indicating it is likely a backend infrastructure address rather than a public-facing endpoint.

4. Low Neighborhood Risk: The /24 subnet shows clean abuse density with minimal sibling risk, suggesting isolated behavior.

Recommendation: Monitor blacklist listings and verify specific reasons for listing. Consider blocking if organization has strict cloud provider policies, but note this may be legitimate Google Cloud infrastructure.

---

*Report generated by IPDebrief Intelligence Platform. Data subject to change. Combine with other signals before taking action.*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.