Known public DNS resolver (Google Public DNS).
- ASN kind
- cloud
- ASN operator
- Public resolver
- Google Public DNS
Verdict
BENIGNHigh confidence
Legitimacy is verified by a trusted source, not only suggested by a lack of detections.
4Supporting signals
4Independent sources
2Recent observations
0 / 100Threat score
Why the engine decided this
Deterministic engine · activity none- KNOWN_PUBLIC_DNS Indicator is a well-known public recursive DNS resolver.
- OTX_KNOWN_FALSE_POSITIVE AlienVault OTX marks the indicator as a known false positive or whitelisted.
- ABUSEIPDB_ALLOWLIST AbuseIPDB lists the IP on its allowlist.
- Google Public DNS public DNS resolver: abuse reports usually describe traffic relayed through the service.
Key indicators
- IP address
- 8.8.8.8
- ASN
- AS15169
- Holder
- GOOGLE - Google LLC
- Network
- GOGL
- Prefix
- 8.8.8.0/24
- ISP
- Google LLC
- Usage
- Content Delivery Network
- Open ports
- 53, 443
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-26 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| IOCSCAPE knowledge base | Known public DNS resolver (Google Public DNS). | — | — | Benign |
 AbuseIPDB | Allowlisted with 0% confidence despite 212 reports; report volume here is noise. | 0% | 0 days recent | Benign |
 AlienVault OTX | Marked as a known false positive or whitelisted. | — | — | Benign |
 VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
 RDAP | Network GOGL (NET-8-8-8-0-2), country unknown; Google LLC. | — | — | Context |
 RIPEstat | Announced in 8.8.8.0/24 by AS15169 (GOOGLE - Google LLC). | — | — | Context |
 Shodan | Open ports 53, 443. | — | — | Context |
Coverage · checked, no record: ThreatFox, URLhaus, Feodo Tracker, Emerging Threats, Tor exit list, DShield · failed: GreyNoise
Analyst summary
Consistent with engineBenign: Google Public DNS is a well-known public resolver. Allowlisted with 0% confidence despite 212 reports; report volume here is noise.
Why the evidence points to benign
- [AbuseIPDB] Allowlisted with 0% confidence despite 212 reports; report volume here is noise.
- [IOCSCAPE knowledge base] Known public DNS resolver (Google Public DNS).
- [AlienVault OTX] Marked as a known false positive or whitelisted.
- [VirusTotal] No vendor flags it (0 of 91).
Lookups failed for GreyNoise: no information either way.
Attribution
Operated by Google Public DNS; reports describe traffic relayed through the service, not the operator's own activity.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyNo group is directly linked to this indicator by any source.
All evidence
14 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| IOCSCAPE knowledge base | Known public DNS resolver (Google Public DNS). | — | — | Benign |
| AbuseIPDB | Allowlisted with 0% confidence despite 212 reports; report volume here is noise. | 0% | 0 days recent | Benign |
| AlienVault OTX | Marked as a known false positive or whitelisted. | — | — | Benign |
| VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
| RDAP | Network GOGL (NET-8-8-8-0-2), country unknown; Google LLC. | — | — | Context |
| RIPEstat | Announced in 8.8.8.0/24 by AS15169 (GOOGLE - Google LLC). | — | — | Context |
| Shodan | Open ports 53, 443. | — | — | Context |
 GreyNoise | Lookup failed: no information either way. | — | — | Failed |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| Feodo Tracker | No record. | — | — | No record |
 Emerging Threats | No record. | — | — | No record |
 Tor exit list | No record. | — | — | No record |
| DShield | Not among the 1,000 IPs most reported by DShield sensors today. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- KNOWN_PUBLIC_DNSIndicator is a well-known public recursive DNS resolver.
- OTX_KNOWN_FALSE_POSITIVEAlienVault OTX marks the indicator as a known false positive or whitelisted.
- ABUSEIPDB_ALLOWLISTAbuseIPDB lists the IP on its allowlist.
- ABUSEIPDB_ZERO_CONFIDENCEAbuseIPDB reports exist but the abuse confidence score is 0%.
- VERIFIED_LEGITIMATELegitimacy is verified by a trusted catalogue or curated list, not only suggested by a lack of detections.
Engine notes
- Google Public DNS public DNS resolver: abuse reports usually describe traffic relayed through the service.
Analyst summary
Consistent with engineBenign: Google Public DNS is a well-known public resolver. Allowlisted with 0% confidence despite 212 reports; report volume here is noise.
Why the evidence points to benign
- [AbuseIPDB] Allowlisted with 0% confidence despite 212 reports; report volume here is noise.
- [IOCSCAPE knowledge base] Known public DNS resolver (Google Public DNS).
- [AlienVault OTX] Marked as a known false positive or whitelisted.
- [VirusTotal] No vendor flags it (0 of 91).
Lookups failed for GreyNoise: no information either way.
Attribution
Operated by Google Public DNS; reports describe traffic relayed through the service, not the operator's own activity.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- IP address
- 8.8.8.8
- ASN
- AS15169
- Holder
- GOOGLE - Google LLC
- Network
- GOGL
- Prefix
- 8.8.8.0/24
- ISP
- Google LLC
- Usage
- Content Delivery Network
- Open ports
- 53, 443
- Tor exit
- No
- First seen
- Not reported by any source
- Last seen
- 2026-09-26 (0 days before)
By source
RDAPNetwork GOGL (NET-8-8-8-0-2), country unknown; Google LLC.
- Org
- Google LLC
- Range
- NET-8-8-8-0-2
- Network
- GOGL
RIPEstatAnnounced in 8.8.8.0/24 by AS15169 (GOOGLE - Google LLC).
- ASN
- 15169
- Holder
- GOOGLE - Google LLC
- Prefix
- 8.8.8.0/24
ShodanOpen ports 53, 443.
- Ports
- 53, 443
- Vulns
- 0
- Hostnames
- dns.google, airwatch.alliantgroup.com
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
KNOWN_PUBLIC_DNS Indicator is a well-known public recursive DNS resolver.
Attribution
Operated by Google Public DNS; reports describe traffic relayed through the service, not the operator's own activity.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-09-26AbuseIPDB: Allowlisted with 0% confidence despite 212 reports
- 2026-09-26VirusTotal: No vendor flags it (0 of 91)
- 2026-09-26Investigated
Run history
3 collections of this indicator- 2026-10-03BENIGN0Stored evidenceShown
- 2026-09-29BENIGN0Stored evidenceOpen
- 2026-09-26LIKELY BENIGN5Live lookupsOpen
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- contextInvestigate the internal host and the domains it queried, not the resolver.
- huntReview the specific traffic that triggered the alert.
Pivot to other tools
Opens the indicator in the source's own site (new tab).