34.104.235.247📋 Copy

# IP Intelligence Briefing: 34.104.235.247/32

Classification: Moderate Risk (Score: 50) | Provider: Google Cloud | Location: Tokyo, Japan

---

## Executive Summary

IP address 34.104.235.247/32 is associated with Google LLC (ASN 396982) within the GOOGL-2 network block (34.64.0.0/10). The IP resolves to a Googleusercontent.com hostname (247.235.104.34.bc.googleusercontent.com). Despite being a Google infrastructure asset, the IP carries a moderate risk score (50) due to DNSBL listings (2 out of 8 lists). The subnet shows no abuse density and is classified as clean.

---

## Technical Profile

Ownership & Network Role:

• Organization: Google LLC
• ASN: 396982
• BGP Prefix: 34.104.224.0/20
• Network Type: Google Cloud infrastructure
• DNS PTR: 247.235.104.34.bc.googleusercontent.com
• Forward Resolution: googleusercontent.com

Geolocation:

• Country: Japan (JP)
• Region: Tokyo
• Distance from origin: 9,212.3 km
• Geo validation: Plausible (ICMP validation blocked)

Service & Threat Indicators:

• Open ports: None detected
• TLS Certificate: Not present
• Known attacker/spam source: No
• Tor exit node: No
• Anycast: No
• IsCloud flag: False (contradictory to Google Cloud classification)

Control Plane Data:

• Origin ASN: 396982
• Route stability: False
• RPKI State: Not available
• DNSSEC: Valid
• DNSBL Listed: 2 of 8 total lists
• Operator Score: 0.3478 (Basic)

---

## Historical Analysis

Observation Count: 23 signals recorded

Temporal Profile:

• Latest observation: 2026-08-13
• Subnet classification history: "Clean" with 0 abuse density
• Threat persistence: None observed
• Ownership changes: 0
• Campaign likelihood: None

The IP has shown stable characteristics with no escalation in risk indicators over the observation period. Subnet-level analysis consistently reports 0 threat siblings within the /24.

---

## Neighborhood Assessment

Subnet: 34.104.235.247/24

• Abuse Density: 0
• Classification: Clean
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 0

No neighboring IPs flagged as malicious. The subnet environment is clean.

---

## Relationship Graph

Key Associations:

• DNS Association: Multiple entries to 247.235.104.34.bc.googleusercontent.com
• Network Association: Multiple entries to GOOGL-2 network
• No external organizational or certificate relationships detected

---

## Recommended Actions

Risk-Based Recommendations:

Given the moderate risk score (50) and DNSBL listings, the following firewall rules are recommended:

iptables:

```bash

iptables -A INPUT -s 34.104.235.247 -j DROP

```

nftables:

```bash

nft add rule inet filter input ip saddr 34.104.235.247 drop

```

nginx:

```nginx

deny 34.104.235.247;

```

pfSense:

```

34.104.235.247/32

```

Cloudflare WAF:

```json

{

"description": "Block 34.104.235.247 — IPDebrief risk score 50",

"action": "block",

"filter": {"expression": "ip.src eq 34.104.235.247"}

}

```

AWS WAF:

```json

{

"Addresses": ["34.104.235.247/32"],

"Description": "IPDebrief risk 50"

}

```

---

## Intelligence Assessment

Threat Level: LOW-MODERATE

While the IP is associated with Google infrastructure, the moderate risk score (50) warrants attention due to DNSBL listings. The subnet environment remains clean with no neighboring threats. This IP may represent a previously abused or misconfigured Google Cloud asset.

Recommended SOC Actions:

1. Implement blocking rules if this IP appears in threat feeds

2. Monitor for any changes in geolocation or service fingerprints

3. Verify if the DNSBL listings correlate with specific abuse campaigns

4. Consider whitelisting if legitimate Google Cloud service traffic is expected from this IP

---

*Report generated: IPDebrief Intelligence Platform*

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.