34.65.22.200📋 Copy

# IP Intelligence Briefing: 34.65.22.200/32

## Executive Summary

IP 34.65.22.200 is associated with Google Cloud infrastructure (GOOGL-2, ASN 396982) with a moderate risk profile (score: 50). The IP shows no active threat indicators, operates on a clean subnet with zero abuse density, and maintains valid RPKI route origin. Two DNSBL listings were detected without supporting threat evidence.

## Technical Profile

Ownership & Geolocation

• Organization: Google LLC
• Netname: GOOGL-2
• ASN: 396982 (allocated 2018-08-15, ARIN registry)
• Geolocation: Zurich, Switzerland (CH)
• CIDR Block: 34.64.0.0/10

Network Classification

• Role: Google Cloud Provider
• Infrastructure: Unknown
• Service Status: Firewalled / No Services
• Open Ports: None detected
• Not classified as: CDN, VPN, Proxy, Tor, Hosting, Mobile, Residential, Anycast

DNS Analysis

• PTR Record: 200.22.65.34.bc.googleusercontent.com
• Forward Resolution: Confirmed (googleusercontent.com)
• Email Auth: SPF and DMARC records present
• DNSBL Listings: 2 of 8 total lists

Control Plane Data

• Origin ASN: 396982
• BGP Prefix: 34.65.16.0/20
• AS Path: 7018 → 15169 → 396982
• RPKI State: Valid
• Route Stability: Unstable (1 route change in 30 days)
• IRR Consistency: Valid

## Threat Indicators

• Risk Score: 50 (Moderate Risk)
• Known Attacker: No
• Spam Source: No
• Tor Exit Node: No
• Abuse Confidence Score: Not available
• Blacklist Count: 0 (despite 2 DNSBL listings)
• Known Campaigns: None
• Threat Persistence Days: 0

## Historical Analysis

• Observation Period: 20 signals captured (August 2026)
• Ownership Changes: 0 (stable ownership)
• Threat Observation Count: 0
• Persistently Malicious: No
• RPKI Validation: Valid (local VRP confirmed)
• Route Stability: Flagged as unstable due to recent route change

## Neighborhood Assessment

• Subnet: 34.65.22.200/24
• Abuse Density: 0 (clean)
• Active Siblings: 0
• Threat Siblings: 0
• Classification: Clean

## Relationship Graph

• DNS Associations: 200.22.65.34.bc.googleusercontent.com
• Network Associations: GOOGL-2

## Recommended Actions

No specific security action recommendations were generated due to lack of confirmed threat indicators. However, the following firewall rules are available for implementation if required:

## Intelligence Assessment

This IP presents a moderate risk profile primarily driven by DNSBL listings without corroborating threat indicators. The infrastructure is Google Cloud-based with valid RPKI validation and a clean subnet classification. No active malicious activity, campaigns, or service exploitation was observed. The moderate risk score warrants monitoring but does not indicate confirmed malicious behavior.

Recommendation: Monitor for sustained malicious activity. Consider whitelisting if legitimate traffic patterns are observed, or implement conservative blocking if the organization's threat tolerance requires it. Verify DNSBL listing reasons through additional intelligence sources before definitive blocking action.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.