34.138.217.59

{ } JSON 🔧 Full Actions API

🤖 Witness AIThis summary was generated by AI and may contain inaccuracies. Verify critical details independently.

IP INTELLIGENCE BRIEFING: 34.138.217.59/32

Classification: Moderate Risk (Score: 60/100)

Timestamp: 2026-08-13

---

OWNERSHIP & GEOLOCATION

The IP address is owned by Google LLC (ASN 396982), operating within the GOOGL-2 network block (34.128.0.0/10). Geolocation data indicates deployment in North Charleston, South Carolina, US. The IP is classified as a Google Cloud infrastructure asset with no open services exposed. DNS resolution points to `59.217.138.34.bc.googleusercontent.com`.

THREAT INDICATORS

The address is listed on 2 DNSBL feeds out of 8 total checks. Control plane analysis shows route stability concerns with the BGP prefix 34.138.208.0/20.

OBSERVATION HISTORY (22 Total Signals)

Recent activity on 2026-08-13 demonstrates active directory enumeration attempts by external actors:

2026-08-13 17:34:30 UTC: 40 404 responses probing `/google-credentials.json` (auto-banned)
2026-08-13 17:34:30 UTC: 30 404 responses probing `/privatekey.key`
2026-08-13 17:34:29 UTC: 20 404 responses probing `/Dockerfile`
2026-08-13 17:34:29 UTC: 10 404 responses probing `/graphql` endpoint (POST method)
2026-08-13 17:34:29 UTC: Hit honeypot at `/graphql`

These signals indicate reconnaissance activity targeting potential sensitive configuration files and API endpoints.

NETWORK CONTEXT

Neighboring IP analysis of the /24 subnet (34.138.217.0/24) shows zero discovered neighbors and zero abuse density, suggesting this is an isolated infrastructure node within the Google Cloud environment.

RECOMMENDED ACTIONS

1. Immediate: Increase logging verbosity for traffic from 34.138.217.59

2. Firewall Rule: Block traffic at perimeter:

- `iptables -A INPUT -s 34.138.217.59 -j DROP`

- `nft add rule inet filter input ip saddr 34.138.217.59 drop`

- Cloudflare/AWS WAF blocks also recommended

3. Monitoring: Review for any inbound connections attempting to access `/google-credentials.json`, `/privatekey.key`, `/Dockerfile`, or `/graphql` paths from this IP

---

ASSESSMENT: The IP presents moderate risk with evidence of automated directory enumeration activity. While the IP is associated with Google Cloud infrastructure, the enumeration attempts suggest either a compromised asset or a third-party scanning operation. Recommend implementing the recommended firewall rules and increasing monitoring until activity subsides.

Analyst: IPDebrief Intelligence

Source: IPDebrief Platform

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.

🚫

Auto-Banned IP — Auto-banned by enumeration detection on 2026-08-13.

Reason: Auto-ban: 5 security violations in 5min (last: enumeration/directory-enumeration)

⚠️ Admin review: pending

🌍 Geolocation

Country	🇺🇸 United States
Region	South Carolina
City	North Charleston
Timezone	—
Latitude	32.86
Longitude	-79.97

🛡️ Platform Security History

Honeypot	Trap endpoint probes	1
Enumeration	Path/resource enumeration	4

Total events: 5

Observed on 2026-08-13

🏢 Ownership & Registration

Organization	Google LLC
ASN	AS396982
Network Name	GOOGL-2
CIDR Block	34.128.0.0/10
RIR	ARIN
Country	United States
Abuse Contact	Available via RDAP

🌐 DNS Intelligence

PTR	59.217.138.34.bc.googleusercontent.com
Forward Confirmed	Yes — FCrDNS verified
Forward Hostnames	`59.217.138.34.bc.googleusercontent.com`

🔐 DNS Hygiene

Hygiene Score	100% (Excellent)
SPF	Present
DMARC	Present
FCrDNS	Verified
DNSSEC	Valid
CAA	Present

☁️ Network Classification

Infrastructure	Infrastructure / Datacenter
Service Purpose	Web Server
Network Tier	Tier 3 — Basic operator with some routing infrastructure

CloudHosting

🔌 Services & Open Ports

Port	Service	Protocol	Banner
443	https	tcp	—
Closed Ports	22, 25, 80, 3389, 8080, 8443 (1 open / 7 scanned)

Server	—
HTTP Title	—

🔐 TLS Certificate

A self-signed certificate was detected. This is common for development servers, internal services, or IoT devices.

⚠️

CN=tarsier.cloudshell.svc

Issued by CN=tarsier.cloudshell.svc

Self-signed: Yes

SANs	None
Valid From	2026-08-27T13:58:44+00:00
Valid Until	2026-11-25T13:58:44+00:00

🎯 Confidence Breakdown

Per-dimension confidence scores based on source diversity and data freshness

Dimension	Score	Sources	Observations
threat	25%	1	1
routing	25%	1	1
services	25%	1	1
ownership	0%	0	0
reputation	0%	0	0
geolocation	35%	2	2
Overall	18%	5	5

Coverage: 4/6 dimensions · Data sufficiency: partial

Data Coherence	Mostly Consistent (80%) — 1 contradiction(s)
Attribution	Moderate (55%)
	OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid

⚠ Claimed geolocation contradicts RTT physics measurement

📅 Observation Timeline 🔄 Live

First Seen	2026-08-10 05:12:01 UTC
Last Seen	2026-08-30 22:47:37 UTC
Profile Built	2026-08-30 22:54:09 UTC
Data Freshness	Live
Signal Types	24
Total Observations	31

🔍 24 signal types · 31 observations collected

This report is generated from 24+ independent intelligence signals including ownership records, DNS analysis, BGP routing, TLS certificates, port scanning, threat feeds, behavioral fingerprinting, and more.
Full dossier details are available via our API.

{ } JSON API 🔧 Actions API 📧 Enterprise Access

ℹ️ About This Report

All data shown is publicly available network metadata — IP addresses do not reliably identify individuals. Assessments are probabilistic and should not be used as sole basis for access control decisions. To report an issue or request data review, contact admin@ipdebrief.com.

34.138.217.59📋 Copy