35.247.204.253📋 Copy

## IP Intelligence Briefing: 35.247.204.253/32

Date: 2026-06-20

Classification: Low Risk

Report Type: Cloud Infrastructure Assessment

---

Executive Summary

IP address 35.247.204.253 is a Google Cloud infrastructure asset located in São Paulo, Brazil. The address presents minimal threat indicators with a risk score of 25 (Low Risk). No active malicious campaigns, known attacker signatures, or spam source indicators were detected. The IP operates within a firewalled cloud compute environment with no open services exposed.

---

Ownership and Infrastructure

---

Geolocation Data

---

Threat Assessment

Risk Metrics:

• Overall Risk Score: 25 (Low Risk)
• Abuse Confidence: None detected
• Blacklist Status: Not listed on major threat feeds
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No

DNSBL Status: Listed on 1 of 8 DNSBL lists (dnsblListedCount: 1)

Threat Indicators: None detected across all analyzed threat feeds.

---

Network Services and DNS

Email authentication records (SPF/DMARC) are present for the associated domain.

---

BGP and Routing Analysis

• BGP Prefix: 35.247.192.0/20
• AS Path: 1403 → 15169 → 396982
• Route Stability: Stable (no route changes in 30 days)
• MoAS Status: Not a MoAS
• RPKI State: Validated
• IRR Consistency: Consistent

---

Neighborhood Analysis (Subnet: 35.247.204.0/24)

The subnet demonstrates minimal abuse activity with low inherited risk.

---

Historical Observations (Last 24 Signals)

Recent observations from 2026-06-20 confirm:

• ASN assignment status: Assigned and stable
• BGP routing: Stable with established path
• Classification: Consistently "mostly_clean"
• Campaign likelihood: None
• No persistent malicious activity detected

---

Relationship Graph (41 Relationships)

Key associations identified:

• DNS Associations: 253.204.247.35.bc.googleusercontent.com (multiple entries)
• Network Associations: GOOGLE-CLOUD network
• Service Links: Cloud infrastructure dependencies

---

Recommended Security Actions

Based on the low-risk profile and Google Cloud infrastructure context:

1. Allow Traffic: No blocking recommended for standard cloud traffic

2. Monitoring: Standard cloud security monitoring applies

3. Firewall Rules: No specific iptables/nftables rules required

4. WAF Configuration: No Cloudflare/AWS WAF rules needed for this IP

---

Analyst Notes

This IP represents legitimate Google Cloud infrastructure with no detected malicious activity. The IP is part of the googleusercontent.com domain infrastructure, which handles Google services including content delivery and user-facing applications. The single DNSBL listing appears to be a false positive or routine listing. No defensive blocking is warranted, though standard cloud security monitoring should remain active.

Threat Level: LOW

Action Required: None

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.