34.26.231.215📋 Copy

# IP INTELLIGENCE BRIEFING

Subject: 34.26.231.215/32

Classification: Moderate Risk (65/100)

Date: Current

Status: Legitimate Cloud Infrastructure with Monitoring Recommendation

---

## EXECUTIVE SUMMARY

The IP address 34.26.231.215 is identified as Google Cloud infrastructure located in North Charleston, South Carolina, United States. While the IP carries an elevated risk score of 65/100, analysis indicates legitimate cloud hosting activity with no active threat indicators. The IP is associated with Google LLC (ASN 396982) and operates within the GOOGL-2 network block.

## PROFILE DETAILS

Ownership & Network:

• Organization: Google LLC
• ASN: 396982
• Network Name: GOOGL-2
• CIDR Block: 34.4.5.0/24
• RIR: ARIN
• Registration: Available via RDAP

Geolocation:

• Country: United States (US)
• Region: South Carolina
• City: North Charleston
• Coordinates: 32.86°N, -79.97°W
• Timezone: America/New_York

Network Classification:

• Provider: Google Cloud
• Infrastructure Type: Cloud Hosting
• Services: Firewalled / No Services Detected
• Connection Type: Cloud Infrastructure

## THREAT ASSESSMENT

Risk Score: 65/100 (Moderate Risk)

Threat Indicators: None Detected

• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Count: 0
• Known Campaigns: None

Control Plane Data:

• DNSBL Listings: 3/8 total lists
• Route Stability: Unstable (0 route changes in 30 days)
• RPKI State: Not verified
• Operator Score: 0.3478 (Basic)

## OBSERVATION HISTORY

Total Observations: 14 signals collected

Recent Activity: August 6, 2026 timeframe

Signal Breakdown:

• Organization identification (Google LLC): 90% confidence
• ASN/RIR attribution (ARIN): 90% confidence
• Geolocation (North Charleston, SC): 70% confidence
• Network classification (Google Cloud): 90% confidence
• Initial geolocation probe: 35% confidence (US, 2500km accuracy)

Temporal Analysis: No persistent malicious activity detected. The IP demonstrates stable ownership characteristics with zero ownership changes recorded.

## RELATIONSHIP GRAPH

Connected Entities: 3 relationships

1. DNS Association: 215.231.26.34.bc.googleusercontent.com (hostname)

2. Same Network: GOOGL-2 (network)

3. DNS Association: 215.231.26.34.bc.googleusercontent.com (hostname)

Analysis: The IP maintains minimal external associations, primarily DNS-based. No certificate matches or correlated IPs detected.

## NEIGHBORHOOD ANALYSIS

Subnet: 34.26.231.0/24

Neighbor Count: 3 active siblings

Abuse Density: 0/100

Neighbor Risk Profile:

• 34.26.231.27: Risk Score 25, Authority Score 90
• 34.26.231.118: Risk Score 25, Authority Score 90
• 34.26.231.175: Risk Score 25, Authority Score 90

Conclusion: The /24 subnet exhibits low abuse density with all neighboring IPs showing low-risk profiles (25/100). This supports legitimate cloud infrastructure classification.

## SERVICES & PORTS

• Open Ports: None detected
• TLS Certificate: Not available
• HTTP Title: Not available
• Server Banner: Not available

Note: Services may be firewalled or not actively running, consistent with cloud infrastructure patterns.

## RECOMMENDED ACTIONS

Security Recommendation:

• Category: Monitoring
• Severity: High
• Action: Increase logging verbosity and review recent activity from this IP
• Reasoning: Elevated risk score (65/100) warrants enhanced monitoring despite legitimate cloud infrastructure classification

Firewall Rules (For Reference):

Note: These rules are probabilistic and should be combined with other signals before taking action.

---

## INTELLIGENCE NARRATIVE

The IP address 34.26.231.215 belongs to Google Cloud infrastructure operating from North Charleston, South Carolina. Despite a moderate risk score of 65/100, the IP demonstrates characteristics consistent with legitimate cloud hosting: established organization attribution (Google LLC), stable ASN registration, low-abuse-density neighborhood, and no active threat indicators. The 3 DNSBL listings warrant monitoring but do not confirm malicious activity. No open ports or active services were detected, suggesting the IP is either firewalled or used for infrastructure purposes.

SOC Analyst Guidance: Monitor rather than block. The elevated risk score likely reflects Google's conservative security posture on cloud IP ranges. Focus on behavioral analysis rather than signature-based blocking. If unusual patterns emerge from this IP, correlate with organizational context before implementing blocking measures.

Priority: Low-Medium (Monitor)

Action Required: Enhanced logging and activity review

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.