34.138.143.95📋 Copy

IP INTELLIGENCE BRIEFING: 34.138.143.95/32

Classification: Moderate Risk Cloud Infrastructure Asset

Date of Analysis: Current

Analyst: IPDebrief Intelligence Team

---

EXECUTIVE SUMMARY

IP address 34.138.143.95 was identified as a Google Cloud infrastructure endpoint with a moderate risk classification (Risk Score: 40). The asset operates within legitimate cloud infrastructure but exhibited minor abuse indicators and geolocation validation anomalies. No active threat campaigns or malicious behavior indicators were observed.

---

INFRASTRUCTURE PROFILE

Ownership & Network:

• Organization: Google LLC (ASN: 396982)
• Network Name: GOOGL-2
• CIDR Block: 34.128.0.0/10
• RIR: ARIN
• Registration: Unavailable via RDAP

Geolocation:

• Country: United States
• State: South Carolina
• City: Moncks Corner
• Coordinates: 33.21°N, -80.17°W
• Timezone: America/New_York
• Accuracy Radius: 150km

Infrastructure Classification:

• Provider: Google Cloud
• Infrastructure Type: CloudCompute
• Connection Type: Cloud
• Hosting Provider: Yes
• CDN/VPN/Proxy: No
• Anycast: No

---

THREAT INDICATORS & OBSERVATIONS

Risk Assessment:

• Risk Score: 40/100 (Moderate Risk)
• Abuse Confidence Score: Not available
• Threat Persistence Days: 0
• Persistently Malicious: No

Threat Indicators:

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• Pulsedive Risk: Not available
• Known Campaigns: None
• Threat Feeds: Empty

DNS Reputation:

• DNSBL Listed: 2 of 8 total lists
• PTR Hostname: 95.143.138.34.bc.googleusercontent.com
• Forward Resolution: Confirmed
• Email Auth: SPF and DMARC configured

Service Exposure:

• Open Ports: None (Firewalled)
• TLS Certificate: Not detected
• HTTP Title: Not detected
• Server Banner: Not detected

---

TEMPORAL ANALYSIS

Observation History:

• Total Observations: 28
• Recent Activity: June 2026 (within 28-day window)
• Ownership Changes: 0
• Threat Observation Count: 1
• Threat Persistence: Not persistent

Stability Metrics:

• Average Ownership Days: Not applicable (cloud infrastructure)
• Route Stability: Stable
• Route Changes (30d): 0
• Is MOAS: No
• RPKI State: Not evaluated
• IRR Consistency: Not evaluated

---

NETWORK NEIGHBORHOOD ANALYSIS

Subnet Profile:

• Subnet: 34.138.143.95/24
• Abuse Density: 1 (Low)
• Classification: Mostly Clean
• Inherited Risk: 2

Sibling Analysis:

• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1

The immediate /24 neighborhood shows minimal abuse density with one identified threat sibling, suggesting this is not part of a coordinated malicious network.

---

RELATIONSHIP ANALYSIS

DNS Associations:

• Primary Hostname: 95.143.138.34.bc.googleusercontent.com
• Forward Resolution: Confirmed
• Hosted Domains: 0

Network Relationships:

• Same Network: GOOGL-2
• Multiple redundant DNS and network associations detected

The relationship graph shows standard cloud infrastructure patterns with consistent DNS and network associations to Google-owned infrastructure.

---

GELOCATION VALIDATION

Validation Status:

• GeoPlausible: False
• Distance: 6,958km (from probe origin)
• Minimum Possible RTT: 139.2ms
• Observed RTT: 39ms (Violation)
• Probe Count: 5

Assessment: The geolocation data shows a significant RTT violation, indicating the IP's reported location may not match actual routing paths. This is common in cloud infrastructure where routing paths diverge from geographic expectations.

---

CONTROL PLANE ANALYSIS

BGP Routing:

• Origin ASN: 396982
• BGP Prefix: 34.138.128.0/20
• AS Path: 57866, 15169, 396982
• Is Route Stable: Yes
• Is MOAS: No

DNS Security:

• DNSSEC Valid: Yes
• Has CAA: Yes
• Delegation Age: 2,857 days

---

RECOMMENDED ACTIONS

Firewall Rules:

Assessment: The moderate risk score and presence of DNSBL listings warrant consideration for blocking, though this is Google Cloud infrastructure. Investigation recommended to confirm if traffic patterns align with expected legitimate cloud behavior or indicate compromised resources.

---

INTELLIGENCE CONCLUSION

IP 34.138.143.95 is classified as a Google Cloud infrastructure endpoint with moderate risk indicators. The asset demonstrates legitimate cloud infrastructure characteristics but maintains DNSBL listings that warrant monitoring. No active threat campaigns or malicious behavior were observed in the analysis window. The single threat sibling in the /24 neighborhood suggests potential localized abuse but not coordinated activity.

SOC Analyst Guidance:

• Monitor traffic patterns for anomalies
• Verify if IP traffic originates from expected Google Cloud services
• Consider blocking if traffic does not align with organizational use cases
• Maintain awareness of the 1 threat sibling in the neighborhood
• No immediate threat escalation required

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.