34.38.181.87📋 Copy

# IP Intelligence Briefing: 34.38.181.87/32

## Executive Summary

On 2026-08-06, IP 34.38.181.87 was observed with a moderate risk score of 50. The address is owned by Google LLC (ASN 396982) and operates from Google Cloud infrastructure. While the subnet (34.38.181.0/24) shows clean classification with zero abuse density, the IP is listed on 2 of 8 DNS blacklists and has been geolocated inconsistently between Brussels, Belgium and the United States across 14 historical observations.

## Ownership and Infrastructure

• Organization: Google LLC
• ASN: 396982 (GOOGL-2)
• CIDR Block: 34.4.5.0/24
• Provider Type: Google Cloud
• Geolocation: Brussels, Belgium (BE) - 2,500km accuracy radius
• BGP Prefix: 34.38.0.0/16
• Route Stability: False (route changes observed)

## Network Classification

• Classification: Firewall / No Services
• Open Ports: None detected
• TLS Certificates: None
• HTTP Banner: None
• Infrastructure Type: Unknown
• CDN/VPN/Proxy/Tor: Not classified as any
• Mobile/Residential/Hosting: Not applicable

## DNS Resolution

• PTR Hostname: 87.181.38.34.bc.googleusercontent.com
• Forward Resolution: Confirmed
• Email Authentication: SPF and DMARC records present
• Forward Hostnames: 87.181.38.34.bc.googleusercontent.com

## Threat Intelligence Indicators

• Risk Score: 50 (Moderate Risk)
• Abuse Confidence: Not flagged
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Blacklist Status: Listed on 2 of 8 DNSBL lists
• Known Campaigns: None identified
• Threat Feeds: Empty

## Neighborhood Analysis (34.38.181.0/24)

• Subnet Classification: Clean
• Abuse Density: 0
• Total Siblings: 2
• Active Siblings: 1
• Threat Siblings: 0
• Neighbor IP: 34.38.181.146 (risk score: 15, authority score: 90)

## Historical Observations (14 Total)

Observations recorded from 2026-08-06 show:

• Classification: Consistently "clean" with 0 inherited risk
• Abuse Density: 0 across all observations
• Geolocation: Inconsistent reporting (Belgium and United States)
• ASN/Org: Consistent Google LLC identification
• DNSBL Listings: 2 out of 8 lists flagged with high severity

## Recommended Security Actions

Based on the moderate risk profile and DNSBL listings, the following blocking rules are recommended:

iptables: `iptables -A INPUT -s 34.38.181.87 -j DROP`

nftables: `nft add rule inet filter input ip saddr 34.38.181.87 drop`

nginx: `deny 34.38.181.87;`

pfSense: `34.38.181.87/32`

Cloudflare WAF: Block with expression `ip.src eq 34.38.181.87`

AWS WAF: Add to IPSet `34.38.181.87/32`

## Analysis Notes

While the IP operates within Google Cloud infrastructure and the /24 subnet maintains clean classification, the moderate risk score and DNSBL listings suggest potential abuse patterns. The inconsistent geolocation reporting and route instability warrant monitoring. The lack of open services indicates this address may be used for infrastructure or management purposes rather than public-facing services. SOC teams should correlate this IP with other threat indicators before implementing permanent blocks, given the Google Cloud ownership context.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.