34.140.52.237
## INTELLIGENCE BRIEFING: IP 34.140.52.237/32
Classification: Moderate Risk (Score: 50/100)
Date: Current Assessment
Platform: Google Cloud (GOOGL-2)
---
Ownership & Infrastructure
The IP address 34.140.52.237 belongs to Google LLC (ASN 396982) within the 34.128.0.0/10 CIDR block (GOOGL-2). The infrastructure is classified as CloudCompute with hosting capabilities. Reverse DNS resolution points to 237.52.140.34.bc.googleusercontent.com, confirming Google Usercontent association.
Geolocation
Geolocation data indicates deployment in Brussels, Belgium (BRU). Multiple geo-sources were consulted (geoSourceCount: 2), though consensus among sources was not achieved (geoConsensus: false).
Threat Indicators
The IP demonstrates moderate risk characteristics:
- Abuse Confidence: Present on threat feeds
- Blacklist Status: Listed on 2 of 8 threat intelligence feeds with high severity ratings
- Control Plane: Route stability flagged as false; 2 DNSBL listings active
- Known Campaigns: None identified
- Threat Feeds: Multiple indicators of compromise detected in historical observations
Observation History
Sixteen signal observations have been recorded. Recent activity includes:
- Geolocation signals from Brussels, Belgium (AlienVault-OTX source)
- Threat indicators with high severity listings
- DNSSEC validation confirmed
- Domain associations with googleusercontent.com
Network Relationships
The IP shares network relationships within the GOOGL-2 infrastructure block. DNS associations link to 237.52.140.34.bc.googleusercontent.com.
Neighborhood Analysis
No neighboring IP addresses were identified in the /24 subnet with threat data. Abuse density for the subnet is negligible.
---
## RECOMMENDED ACTIONS
Based on the moderate risk profile (Score: 50) and threat feed listings, the following measures are recommended:
| Platform | Action |
|---|---|
| iptables | `iptables -A INPUT -s 34.140.52.237 -j DROP` |
| nftables | `nft add rule inet filter input ip saddr 34.140.52.237 drop` |
| nginx | `deny 34.140.52.237;` |
| pfSense | `34.140.52.237/32` (block rule) |
| Cloudflare WAF | Block with expression: `ip.src eq 34.140.52.237` |
| AWS WAF | Add to IP set with address: `34.140.52.237/32` |
---
## ANALYST NOTES
While this IP is hosted on Google Cloud infrastructure, the presence of high-severity threat feed listings warrants defensive blocking. The IP is associated with Google Usercontent services, which may be legitimate but has demonstrated malicious activity patterns. SOC teams should evaluate the specific use case before implementation, as blocking legitimate Google Cloud endpoints may impact certain workflows.
Priority: Monitor
Status: Actionable Threat Intelligence
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | Google LLC |
| ASN | AS396982 |
| Network Name | GOOGL-2 |
| CIDR Block | 34.128.0.0/10 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | 237.52.140.34.bc.googleusercontent.com |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | 237.52.140.34.bc.googleusercontent.com |
🔐 DNS Hygiene
| Hygiene Score | 100% (Excellent) |
| SPF | 2/5 domains |
| DMARC | 2/5 domains |
| FCrDNS | Verified |
| DNSSEC | Valid |
| CAA | Present |
| Domains Checked | 5 domains |
☁️ Network Classification
| Infrastructure | Infrastructure / Datacenter |
| Service Purpose | Firewalled / No Services |
| Network Tier | Tier 3 — Basic operator with some routing infrastructure |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| No open ports detected | |||
| Closed Ports | 22, 25, 80, 443, 3389, 8080, 8443 (0 open / 7 scanned) | ||
| Server | — |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | None |
| Valid From | — |
| Valid Until | — |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 27% | 2 | 2 |
| routing | 13% | 1 | 1 |
| services | 19% | 2 | 2 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 2 |
| geolocation | 27% | 2 | 3 |
| Overall | 21% | 10 | 13 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-08-13 06:44:45 UTC |
| Last Seen | 2026-08-30 18:27:51 UTC |
| Profile Built | 2026-08-30 18:37:39 UTC |
| Data Freshness | Live |
| Signal Types | 23 |
| Total Observations | 32 |
Full dossier details are available via our API.