34.34.28.117📋 Copy

IP INTELLIGENCE BRIEFING: 34.34.28.117/32

Subject: Google Cloud Infrastructure IP Assessment

---

Executive Summary

IP 34.34.28.117 is associated with Google LLC (ASN 396982, network GOOGL-2) and classified as Moderate Risk (Score: 50). The IP resolves to googleusercontent.com with a PTR hostname 117.28.34.34.bc.googleusercontent.com. Despite the moderate risk score, the subnet (34.34.28.0/24) demonstrates clean abuse density (0) with no threat siblings observed.

Ownership & Infrastructure

• Organization: Google LLC
• ASN: 396982
• RIR: ARIN
• Network Block: 34.4.5.0/24
• Infrastructure Type: Cloud (Google Cloud Platform)
• Service Status: Firewalled / No Services Detected
• Open Ports: None identified

Geolocation Data

Primary location reporting: Netherlands (NL), Groningen region. Historical observations show conflicting geolocation data (US coordinates 39.83, -98.58 observed). Geo validation indicates false plausible distance calculations. Multiple geolocation sources used with consensus enabled.

Network Classification

• Is Cloud: False
• Is CDN: False
• Is VPN/Proxy/Tor: False
• Is Mobile/Residential: False
• DNSBL Listings: 2 of 8 threat intelligence lists
• Route Stability: Unstable (route changes observed in 30-day window)
• RPKI State: Not reported

Threat Indicators

• Abuse Confidence Score: Not calculated
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Known Campaigns: None identified
• Blacklist Count: 0 (primary threat feeds)
• Pulsedive Risk: Not reported

Observation History

Sixteen observations recorded. No ownership changes detected. Threat persistence days: 0. No persistently malicious activity flagged. Recent scans show SSH-2.0-OpenSSH_10.0 banner in nested data. No significant threat pattern evolution observed over the assessment period.

Relationship Analysis

DNS associations consistently resolve to 117.28.34.34.bc.googleusercontent.com. Network relationships link to GOOGL-2 infrastructure. No anomalous relationships detected.

Subnet Neighborhood Assessment

Subnet 34.34.28.0/24:

• Abuse Density: 0 (clean)
• Total Siblings: 1
• Active Siblings: 0
• Threat Siblings: 0
• Risk Distribution: No high/medium risk neighbors

Recommended Security Actions

While risk score indicates moderate concern (50), the IP shows Google Cloud infrastructure characteristics with no active threat indicators. Recommended actions are probabilistic and should be validated with additional signals:

• Firewall Rules: Block at perimeter (iptables/nftables) if threat correlation supports action
• Cloudflare WAF: Block rule with expression "ip.src eq 34.34.28.117"
• AWS WAF: IPSet rule for 34.34.28.117/32
• Nginx: deny directive applicable

Assessment

This IP exhibits Google Cloud infrastructure characteristics with moderate risk scoring primarily from DNSBL listings rather than active threat indicators. The subnet environment is clean with no associated malicious activity. SOC teams should evaluate blocking decisions based on observed threat correlation rather than risk score alone. No immediate threat action recommended without additional context or correlation to specific incidents.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.