34.23.187.194📋 Copy

IP INTELLIGENCE BRIEFING: 34.23.187.194/32

Executive Summary

IP 34.23.187.194 is a Google Cloud infrastructure endpoint classified as Moderate Risk (score: 50). The IP resolves to Google LLC (ASN: AS396982) with a reverse DNS hostname of 194.187.23.34.bc.googleusercontent.com. No active services or open ports detected. The IP is listed on 2 DNSBLs with one high-severity listing observed in historical data.

Ownership & Infrastructure

• Organization: Google LLC (GOOGL-2)
• ASN: AS396982
• Infrastructure Type: Google Cloud (Cloud Compute hosting)
• Geolocation: North Charleston, South Carolina, US (claimed)
• DNS: googleusercontent.com (PTR: 194.187.23.34.bc.googleusercontent.com)
• Email Authentication: SPF and DMARC records present

Threat Profile

• Risk Score: 50 (Moderate)
• Operator Score: 0.3478 (Basic)
• Control Plane Status: DNSBL listed on 2 of 8 total lists
• Known Indicators: Not classified as Tor exit, known attacker, or spam source
• Threat Persistence: No persistent malicious behavior detected

Observation History (24 signals)

Historical analysis reveals:

• Consistent classification as Google Cloud infrastructure
• Mixed proxy/VPN classifications in historical observations
• One observation noted ISP classification as VPN/proxy type
• Geolocation validation issues: claimed distance (6,958km) inconsistent with observed RTT (35-40ms)
• One DNSBL listing with high severity observed

Network Neighborhood

• Subnet: 34.23.187.0/24
• Abuse Density: Low (0)
• Classification: Mostly clean
• Active Siblings: 1 (34.23.187.23)

Recommended Actions

The system recommends blocking this IP due to moderate risk classification. Suggested firewall rules:

• iptables: `iptables -A INPUT -s 34.23.187.194 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 34.23.187.194 drop`
• Cloudflare WAF: Block rule configured for risk score 50
• AWS WAF: Address 34.23.187.194/32 added to block list

Analysis Notes

This IP belongs to legitimate Google Cloud infrastructure hosting infrastructure. While the risk score is moderate and some historical data indicates proxy-like behavior, the IP shows no active threat indicators or known malicious campaigns. The moderate risk rating may reflect the high-severity blacklist listing observed historically. SOC analysts should evaluate against known threat intelligence before implementing blocking rules, considering the legitimate cloud infrastructure context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.