Maximum Danger
IP address 35.203.210.123 is a critical-risk address operating from Google Cloud Platform infrastructure in the United Kingdom, linked to sustained SSH intrusion activity with 1,255 total abuse reports filed through automated honeypot sensors. With a maximum threat-level rating of 10 out of 10, this IP represents one of the most actively malicious sources currently circulating in public threat-intelligence feeds.
The IP belongs to AS396982, Google's cloud infrastructure division, and has been flagged for hostile activity spanning approximately nine months, from August 2025 through May 2026. Community-driven detection systems and automated honeypot sensors have logged consistent report volumes, yielding a 71 percent confidence score in the assessment that this address is deliberately engaged in malicious operations. The dominant threat category across recent reports is general hacking activity, with specific indicators noting unauthorized SSH session establishment on non-standard ports — a technique frequently employed to evade signature-based detection systems.
The concrete risk posed by this address centres on unauthorized remote-access attempts targeting exposed SSH services. Detections referencing SSH sessions on unusual ports suggest the operator is using port-hopping or non-standard service configurations to bypass basic firewall rules and evade elementary monitoring. An attacker successfully establishing such a session could gain interactive command-line access to a target system, potentially escalating privileges and deploying secondary payloads. For organizations running accessible SSH services, even those with default configurations, this activity profile indicates an active, persistent probing campaign that demands immediate defensive action.
Site operators should treat this IP as blocked on sight by implementing firewall deny-rules or network-level ACLs. SSH services should be hardened through key-based authentication exclusively, disabling password-based login entirely. Deploying tools such as fail2ban or equivalent rate-limiting solutions can automatically ban repeated connection attempts from abusive sources. Additionally, monitoring for outbound connections to non-standard ports and maintaining intrusion-detection signatures tuned to known SSH evasion patterns will significantly reduce exposure to this threat category.
JP 
BE 
TW 
AU 
FI 
MX 
RO 
FR 
CA 
LV