34.172.28.0📋 Copy

# Intelligence Briefing: 34.172.28.0

Classification: Low Risk Cloud Infrastructure

Date: 2026-06-21

Analyst: IPDebrief Intelligence Team

---

## Executive Summary

IP address 34.172.28.0 was analyzed as a Google Cloud infrastructure endpoint. The IP maintains a low-risk profile (risk score: 25) with no active threat indicators. The address resolves to Google's public infrastructure under the GOOGL-2 network block (34.128.0.0/10), located in Council Bluffs, Iowa. No security actions are currently recommended based on the observed threat profile.

---

## Ownership and Network Classification

• Organization: Google LLC
• ASN: 396982
• Netname: GOOGL-2
• CIDR Block: 34.128.0.0/10
• Infrastructure Type: CloudCompute
• Network Role: Web Server (Google Cloud Provider)
• RIR Registry: ARIN
• Registration Date: Data unavailable

The IP operates as cloud infrastructure with stable routing. The control plane shows route stability with zero route changes over the past 30 days and an operator score of 0.5652 (Moderate).

---

## Geolocation and Network Positioning

• Country: United States (US)
• Region: Iowa (IA)
• City: Council Bluffs
• Coordinates: 40.8248°N, -96.6878°W
• Timezone: America/Chicago
• Geolocation Accuracy: 830 km radius (multi-signal inference)
• Geo Validation: Plausible (ICMP probe blocked)

The geolocation data shows consistency across multiple signals with geo consensus enabled.

---

## DNS and Service Analysis

• PTR Hostname: 0.28.172.34.bc.googleusercontent.com
• Forward Resolution: Confirmed (1 hostname)
• Open Ports: TCP/443 (HTTPS)
• TLS Certificate Issuer: CN=e1315856-ed9f-4f5c-af70-4401efc84b92
• TLS Certificate Subject: CN=34.66.28.213
• HTTP Status Code: 403 Forbidden
• HSTS: Not present
• HTTP/2: Enabled

DNS associations confirm the IP belongs to the googleusercontent.com domain. Email authentication records (SPF, DMARC) were not resolved in the analysis.

---

## Threat Assessment

• Risk Score: 25 (Low Risk)
• Provider Score: 0
• Authority Score: 0
• Abuse Confidence Score: N/A
• Blacklist Count: 0
• Known Campaigns: None
• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Is Hosting: Yes (Cloud hosting classification)

No threat indicators were detected across threat feeds or reputation sources. The IP is not associated with any known malicious campaigns.

---

## Historical Observations

Analysis retrieved 27 historical observations with the most recent activity dated 2026-06-21. Key historical signals include:

• Port scanning activity detected
• Subnet classification (34.172.28.0/24) classified as "mostly_clean" with abuse density of 1
• One threat observation recorded
• No persistent malicious activity flagged
• Zero ownership changes recorded

The IP's threat profile has remained stable with no escalation in malicious behavior indicators.

---

## Neighborhood Analysis

• Subnet: 34.172.28.0/24
• Abuse Density: 0 (low)
• Classification: Mostly clean
• Total Siblings: 1
• Active Siblings: 1
• Threat Siblings: 1 (discrepancy noted in profile data)

The neighboring subnet shows minimal abuse activity. No neighboring IPs were returned in the neighbor lookup, suggesting this endpoint operates in isolation or the /24 block is lightly utilized.

---

## Relationships

The IP maintains 39 recorded relationships including:

• DNS associations to 0.28.172.34.bc.googleusercontent.com (multiple entries)
• Network associations to GOOGL-2
• Cloud infrastructure relationships

The relationship graph confirms the IP's connection to Google's public infrastructure ecosystem.

---

## Recommended Actions

Current Status: No security actions recommended

• Risk Score: 25 (Low Risk)
• Provider: Google Cloud
• Recommendations: None
• Firewall Rules: None generated

Given the low-risk profile, Google Cloud hosting classification, and absence of threat indicators, no blocking or rate-limiting actions are currently warranted.

---

## Intelligence Conclusion

IP 34.172.28.0 represents legitimate Google Cloud infrastructure with no evidence of malicious activity. The low-risk score (25), absence of blacklist associations, and clean neighborhood profile indicate this endpoint should be treated as benign cloud infrastructure. SOC analysts may monitor for unusual traffic patterns from this IP but no immediate defensive measures are required.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.