Network Report

AS396982 — Google LLC

What Predax has observed across this network's address space, and what it means for traffic screening.

Addresses observed
1,212
100% carried a flag

About this network

Google LLC (AS396982) operates content-delivery and edge infrastructure — the servers that sit in front of websites and deliver their pages, not the machines people browse from. 100% of the 1,212 addresses we have observed on it carry the datacenter flag, and that is a statement about routing, not a warning: this is what a CDN's address space is supposed to look like.

The number that matters here is different: none of the 1,212 observed addresses carried a notable risk score when last checked. Predax deliberately exempts recognised infrastructure operators from the datacenter risk weight — scoring a CDN's addresses as threats would push site owners into blocking the network that serves their own content.

Observed
1,212
distinct addresses checked
Flagged
100%
1,210 with any threat flag
Notable risk
0%
0 scoring 40+
Countries
29
where addresses geolocate

Flag composition

Share of observed addresses carrying each classification when last checked.

VPN00%
Proxy00%
Tor00%
Datacenter1,210100%

Geography

United States
681
Netherlands
155
Germany
110
Canada
85
Belgium
47
India
23
Most-seen cities

Council Bluffs (US) · Groningen (NL) · Frankfurt am Main (DE) · Santa Clara (US) · North Charleston (US) · Montreal (CA)

Observation window

Addresses on this network have been looked up through Predax between February 10, 2026 and August 31, 2026. Each figure on this page reflects an address's most recent check, not a permanent record.

Geographically, the observed addresses span 29 countries, with the largest share (681 of 1,212) geolocating to United States.

A footprint that wide usually means globally distributed infrastructure — the same operator announcing address space from many regions — rather than a network serving one local population.

Should you screen traffic from this network?

Do not block this network. Its addresses are the delivery path for ordinary websites — including, very possibly, your own. A request from here is usually a CDN edge fetching or serving content, not a visitor to screen.

If an address from this network is misbehaving in your logs, judge the behaviour — the request pattern, the endpoints it touches — rather than the network. Its individual report page will show whether anything beyond the infrastructure flags was detected.

Addresses observed on this network

A sample of the most-looked-up addresses — each links to its full report. Capped at 12.

Check Another IP