34.148.8.63📋 Copy

# IP Intelligence Briefing: 34.148.8.63

## Executive Summary

IP 34.148.8.63 is a Google Cloud infrastructure address (AS396982, GOOGL-2) with a moderate risk score of 40. While the IP belongs to legitimate cloud provider infrastructure, historical observations indicate threat activity including blacklist listings and proxy detection flags. The subnet demonstrates clean classification with zero abuse density.

## Infrastructure Profile

• Organization: Google LLC (ASN 396982)
• Network: 34.128.0.0/10 (GOOGL-2)
• Location: Moncks Corner, South Carolina, United States
• Infrastructure Type: CloudCompute (Google Cloud)
• DNS Record: 63.8.148.34.bc.googleusercontent.com
• Open Services: SSH (port 22)

## Risk Assessment

Current risk score of 40 indicates moderate risk. The IP is classified as a single-service cloud host with hosting capabilities enabled. DNSBL analysis shows presence on 2 of 8 monitored lists.

## Threat Indicators

Historical observations from 23 signals reveal:

• Multiple blacklist listings with one high-severity entry (observed 2026-08-13)
• Proxycheck.io flagged as proxy type "Compromised Server" with 100 risk score
• RTT geolocation validation failure (36ms observed vs 139.2ms minimum possible for claimed distance)
• Operator score: 0.3478 (Basic classification)

## Neighborhood Analysis

Subnet 34.148.8.63/24 shows clean classification with zero abuse density. No additional sibling IPs returned in neighbor analysis. The subnet inherits no inherited risk from adjacent addresses.

## Temporal Context

Ownership changes: 0

Threat persistence: 0 days

Threat observation count: 0

The IP is not classified as persistently malicious.

## Recommended Actions

• Monitor for continued blacklist activity
• Evaluate SSH service exposure in cloud context
• Correlate with known malicious activity patterns for Google Cloud IPs
• Consider egress filtering for outbound traffic patterns

## Intelligence Notes

The IP presents a conflicting signal profile: legitimate Google Cloud infrastructure with historical threat indicators. The proxy/compromised server detection may indicate the IP was previously leveraged for malicious purposes or is involved in command-and-control infrastructure. The moderate risk score warrants continued monitoring but does not indicate immediate blocking requirements.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.