Known public DNS resolver (Google Public DNS).
- ASN kind
- cloud
- ASN operator
- Public resolver
- Google Public DNS
Verdict
BENIGNHigh confidence
Legitimacy is verified by a trusted source, not only suggested by a lack of detections.
4Supporting signals
4Independent sources
2Recent observations
0 / 100Threat score
Why the engine decided this
Deterministic engine · activity none- KNOWN_PUBLIC_DNS Indicator is a well-known public recursive DNS resolver.
- OTX_KNOWN_FALSE_POSITIVE AlienVault OTX marks the indicator as a known false positive or whitelisted.
- ABUSEIPDB_ALLOWLIST AbuseIPDB lists the IP on its allowlist.
- Google Public DNS public DNS resolver: abuse reports usually describe traffic relayed through the service.
Key indicators
- IP address
- 8.8.8.8
- ASN
- AS15169
- Holder
- GOOGLE - Google LLC
- Network
- GOGL
- Prefix
- 8.8.8.0/24
- ISP
- Google LLC
- Usage
- Content Delivery Network
- Open ports
- 53, 443
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-26 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| IOCSCAPE knowledge base | Known public DNS resolver (Google Public DNS). | — | — | Benign |
 AbuseIPDB | Allowlisted with 0% confidence despite 212 reports; report volume here is noise. | 0% | 0 days recent | Benign |
 AlienVault OTX | Marked as a known false positive or whitelisted. | — | — | Benign |
 VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
 RDAP | Network GOGL (NET-8-8-8-0-2), country unknown; Google LLC. | — | — | Context |
 RIPEstat | Announced in 8.8.8.0/24 by AS15169 (GOOGLE - Google LLC). | — | — | Context |
 Shodan | Open ports 53, 443. | — | — | Context |
Coverage · checked, no record: ThreatFox, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list, DShield · failed: GreyNoise
Analyst summary
Consistent with engineBenign: Google Public DNS is a well-known public resolver. Allowlisted with 0% confidence despite 212 reports; report volume here is noise.
Why the evidence points to benign
- [AbuseIPDB] Allowlisted with 0% confidence despite 212 reports; report volume here is noise.
- [IOCSCAPE knowledge base] Known public DNS resolver (Google Public DNS).
- [AlienVault OTX] Marked as a known false positive or whitelisted.
- [VirusTotal] No vendor flags it (0 of 91).
Lookups failed for GreyNoise: no information either way.
Attribution
Operated by Google Public DNS; reports describe traffic relayed through the service, not the operator's own activity.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyAll evidence
14 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| IOCSCAPE knowledge base | Known public DNS resolver (Google Public DNS). | — | — | Benign |
| AbuseIPDB | Allowlisted with 0% confidence despite 212 reports; report volume here is noise. | 0% | 0 days recent | Benign |
| AlienVault OTX | Marked as a known false positive or whitelisted. | — | — | Benign |
| VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
| RDAP | Network GOGL (NET-8-8-8-0-2), country unknown; Google LLC. | — | — | Context |
| RIPEstat | Announced in 8.8.8.0/24 by AS15169 (GOOGLE - Google LLC). | — | — | Context |
| Shodan | Open ports 53, 443. | — | — | Context |
 GreyNoise | Lookup failed: no information either way. | — | — | Failed |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
| DShield | Not among the 1,000 IPs most reported by DShield sensors today. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- KNOWN_PUBLIC_DNSIndicator is a well-known public recursive DNS resolver.
- OTX_KNOWN_FALSE_POSITIVEAlienVault OTX marks the indicator as a known false positive or whitelisted.
- ABUSEIPDB_ALLOWLISTAbuseIPDB lists the IP on its allowlist.
- ABUSEIPDB_ZERO_CONFIDENCEAbuseIPDB reports exist but the abuse confidence score is 0%.
- VERIFIED_LEGITIMATELegitimacy is verified by a trusted catalogue or curated list, not only suggested by a lack of detections.
Engine notes
- Google Public DNS public DNS resolver: abuse reports usually describe traffic relayed through the service.
Analyst summary
Consistent with engineBenign: Google Public DNS is a well-known public resolver. Allowlisted with 0% confidence despite 212 reports; report volume here is noise.
Why the evidence points to benign
- [AbuseIPDB] Allowlisted with 0% confidence despite 212 reports; report volume here is noise.
- [IOCSCAPE knowledge base] Known public DNS resolver (Google Public DNS).
- [AlienVault OTX] Marked as a known false positive or whitelisted.
- [VirusTotal] No vendor flags it (0 of 91).
Key indicators
- IP address
- 8.8.8.8
- ASN
- AS15169
- Holder
- GOOGLE - Google LLC
- Network
- GOGL
- Prefix
- 8.8.8.0/24
- ISP
- Google LLC
- Usage
- Content Delivery Network
- Open ports
- 53, 443
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-26 (0 days before)
By source
RDAPNetwork GOGL (NET-8-8-8-0-2), country unknown; Google LLC.
- Org
- Google LLC
- Range
- NET-8-8-8-0-2
- Network
- GOGL
RIPEstatAnnounced in 8.8.8.0/24 by AS15169 (GOOGLE - Google LLC).
- ASN
- 15169
- Holder
- GOOGLE - Google LLC
- Prefix
- 8.8.8.0/24
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
KNOWN_PUBLIC_DNS Indicator is a well-known public recursive DNS resolver.
Attribution
Operated by Google Public DNS; reports describe traffic relayed through the service, not the operator's own activity.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-09-26AbuseIPDB: Allowlisted with 0% confidence despite 212 reports
- 2026-09-26VirusTotal: No vendor flags it (0 of 91)
- 2026-09-26Investigated
Run history
3 collections of this indicator- 2026-10-03BENIGN0Stored evidenceShown
- 2026-09-29BENIGN0Stored evidenceOpen
- 2026-09-26LIKELY BENIGN5Live lookupsOpen
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- contextInvestigate the internal host and the domains it queried, not the resolver.
- huntReview the specific traffic that triggered the alert.
Pivot to other tools
Opens the indicator in the source's own site (new tab).