8.229.184.160📋 Copy

# IP Intelligence Briefing: 8.229.184.160/32

Classification: Moderate Risk — Legitimate Cloud Infrastructure with Monitoring Flags

---

## Executive Summary

IP 8.229.184.160 is a Google Cloud-hosted server located in Oregon, United States. The address resolves to a legitimate Google infrastructure domain (googleusercontent.com) with valid SPF and DMARC email authentication records. Despite a moderate risk score of 50, no active threat indicators or malicious campaigns were identified. The IP is associated with a single-service host role and SSH service exposure.

---

## Technical Profile

---

## Network Services & Exposed Ports

• SSH (TCP/22): Open with banner `SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.16`
• DNS Reverse Resolution: `160.184.229.8.bc.googleusercontent.com`
• Forward DNS: Confirmed single resolution to Googleusercontent domain
• Email Authentication: SPF and DMARC records present

---

## Threat Analysis

Active Threat Indicators

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Campaign Matches: None detected
• Threat Feeds: No correlations

Control Plane Signals

• Route stability: False
• RPKI state: Not verified
• DNSBL listings: 2 of 8 total lists
• Operator score: 0.3478 (Basic)

---

## Historical Observations

Eighteen signal observations recorded as of 2026-08-13:

• Recent subnet classification: "clean" with 0 abuse density
• Geolocation consistency: US-based with 2500km accuracy radius
• RTT validation: 82–95ms observed against 160.7ms minimum possible (8033km distance)
• No persistent malicious behavior detected (threatPersistenceDays: 0)
• Ownership stability: No changes recorded

---

## Neighborhood Analysis

Subnet 8.229.184.160/24 shows minimal threat activity:

• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 0
• Abuse Density: 0
• Neighbor Risk: 8.229.184.168 (Score: 25, Authority: 90)

---

## Recommended Actions

Given the moderate risk score and Google Cloud infrastructure association, the following rules were generated:

---

## Intelligence Assessment

This IP address represents a legitimate Google Cloud service endpoint rather than malicious infrastructure. The moderate risk score appears driven by DNSBL listings and automated control plane anomalies rather than confirmed threat activity. The SSH service exposure is consistent with cloud-hosted administrative access.

Recommendation: Monitor for behavioral anomalies rather than blocking. The IP may be involved in legitimate cloud operations, and blocking could disrupt service availability. Investigate any traffic from this source only if accompanied by additional threat signals.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.