34.56.229.114📋 Copy

# IP Intelligence Briefing: 34.56.229.114/32

## Executive Summary

IP address 34.56.229.114 operates within Google Cloud infrastructure with an overall low-risk profile (risk score: 25). The IP is associated with Google LLC (ASN 396982) and functions as a web server/hosting service. While the IP shows minimal malicious activity, it is listed on 1 of 8 DNS blacklists and is linked to a single threat sibling in its /24 neighborhood.

## Risk Assessment

Risk Score: 25 (Low Risk)

Reputation: Low Risk

Abuse Confidence: Not elevated

Blacklist Status: 1/8 DNSBL entries

Classification: CloudCompute / Web Server

## Infrastructure Profile

• Organization: Google LLC
• ASN: 396982
• Network: GOOGL-2
• BGP Prefix: 34.56.0.0/16
• Geolocation: Council Bluffs, IA, US
• Infrastructure Type: Google Cloud Platform
• Status: Active cloud compute host

## Network Services

TLS Certificate: Let's Encrypt (CN=demos.biwares.com)

Server Banner: Apache/2.4.67 (Debian)

DNS Records: googleusercontent.com ptr hostname

## Threat Indicators

• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No
• Campaign Association: None detected
• Threat Observation Count: 1
• Threat Persistence: 0 days (not persistent)
• Persistently Malicious: No

## Neighborhood Analysis

Subnet: 34.56.229.114/24

• Abuse Density: 1 (low)
• Classification: Mostly clean
• Threat Siblings: 1
• Active Siblings: 1
• Total Siblings: 1

## Historical Observations (27 records)

Recent observations (2026-06-21) confirm:

• Subnet abuse density: 1
• Classification: mostly_clean
• Inherited risk: 2
• No ownership changes detected
• Not persistently malicious

## Relationships

• DNS Associations: 114.229.56.34.bc.googleusercontent.com
• Network Associations: GOOGL-2 (multiple)
• Total Relationships: 52

## Recommended Actions

1. Monitoring: Continue monitoring for changes in blacklist status or new threat indicators.

2. SSH Exposure: The open SSH port (22) on a public-facing cloud instance warrants review for unauthorized access attempts.

3. DNSBL Investigation: Investigate the single DNSBL listing to understand the listing reason and determine if action is required.

4. Geolocation Validation: Note RTT/geo discrepancy (7218.7km vs minimum possible 144.4ms) indicates potential geolocation inaccuracy.

5. Certificate Review: TLS certificate subject (demos.biwares.com) may warrant validation against legitimate business use.

## Conclusion

This IP represents a standard Google Cloud web hosting instance with minimal threat indicators. While not actively malicious, the open SSH port and DNSBL listing warrant standard defensive monitoring. No immediate blocking is recommended; however, the SSH exposure should be evaluated for necessity on a publicly accessible cloud instance.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.