Maximum Danger
IP 35.216.172.131 is a maximum-threat-level address operated within Google Cloud infrastructure (AS15169) that has accumulated 189 independent abuse reports across automated honeypot sensors between October 2025 and May 2026, indicating sustained malicious activity originating from what appears to be a cloud-hosted environment in Switzerland. Despite a relatively low activity frequency score of 2 out of 10, the IP carries a 10 out of 10 threat level, suggesting that each detected engagement poses severe risk to targeted systems.
The detection data reveals 189 total reports sourced from 20 distinct honeypot sensors, with the dominant threat categories being Hacking (17 reports), Exploited Host (10 reports) and Web App Attack (3 reports). Network inspection captured multiple Suricata signatures including indicators of SMBv1 protocol usage associated with malware and exploit delivery, HTTP unexpected request body anomalies pointing to exploitation tooling, and TLS invalid record type signatures consistent with encrypted command-and-control communications. The combination of these patterns across a major cloud provider's IP space suggests the address is likely functioning as an attack platform, either through compromise of a cloud-hosted asset or deliberate abuse of the provider's infrastructure for threat operations.
The reported Exploited Host classification indicates this IP may belong to a legitimate system that has been compromised and weaponised without the owner's knowledge, a common occurrence in cloud environments where misconfigurations or unpatched services become entry points for attackers. The Web App Attack signatures suggest active probing for OWASP Top 10 vulnerabilities, while the SMBv1 and malware-related Suricata alerts align with lateral movement and remote-code-execution techniques frequently observed in ransomware and espionage operations. The TLS anomalies particularly indicate sophisticated threat actors employing encrypted channels to evade detection.
Site operators with exposed services should immediately block this IP at the network perimeter and implement fail2ban or similar dynamic firewall rules to auto-blacklist repeat offenders. All exposed web applications should be audited against OWASP Top 10 vulnerabilities, with particular attention to file-inclusion and injection vectors. Systems should be reviewed for unnecessary SMBv1 usage and legacy TLS configurations. Organizations operating Google Cloud infrastructure should consider reporting this IP to Google's Trust and Safety team for abuse investigation, and ensure cloud-hosted assets follow hardening guidelines including least-privilege IAM policies and regular vulnerability scanning.
BE 
GB 
MC 
UA 
SE