Critical Threat
IP 147.185.132.35 is a maximum-threat-level address associated with confirmed hacking activity, detected by automated honeypot sensors across a six-month period with 161 abuse reports filed. Operating from Google Cloud Platform infrastructure in the United States under ASN AS396982, this IP presents a serious risk to any exposed services and warrants immediate defensive action.
The data shows 161 total reports sourced from 20 distinct automated honeypot sensors, with a 77% confidence rating indicating high reliability in the threat assessment. Activity spanned from November 2025 through May 2026, demonstrating persistent rather than burst behavior at a frequency rated 3 out of 10. All 20 recent threat-category reports were classified as hacking activity, encompassing general intrusion attempts, vulnerability exploitation and unauthorized access attempts. The presence of confirmed honeypot detections confirms this is not a false positive but an address actively engaged in malicious reconnaissance or exploitation campaigns originating from Google Cloud infrastructure.
Hacking activity detected from this address means automated systems are systematically probing for vulnerable services, unpatched software or misconfigured access controls. Attackers frequently leverage cloud platform IP ranges because they benefit from reputable network standing that may bypass basic allowlists. The confirmed honeypot hits suggest active scanning for entry points into target systems, potentially preceding data exfiltration, lateral movement or further compromise of downstream infrastructure.
Site operators should block this IP address at the firewall or network edge immediately. Deploying intrusion detection systems and configuring fail2ban rules to automatically ban repeated offenders provides layered defense. Ensuring all exposed services are fully patched and authentication mechanisms enforce strong, unique credentials reduces susceptibility to whatever specific techniques this actor is deploying. Ongoing traffic monitoring for similar patterns from adjacent cloud IP ranges is strongly advised given the infrastructure source.
JP 
BE 
AM 
HK 
PT 
FR 
LU 
GB 
PH 
MY