Elevated Risk
IP 147.185.133.148 is a moderate-to-high-risk address operating from Google Cloud Platform infrastructure in the United States, with 170 total abuse reports tied to general hacking activity including intrusion attempts and exploitation of vulnerabilities. The IP, assigned to ASN AS396982 under GOOGLE-CLOUD-PLATFORM, has been flagged by automated honeypot sensors since September 2025, with the most recent confirmed reports dating to May 2026.
Detection data shows 20 distinct reports from automated honeypot sources attributing hacking-related behavior to this address, with a threat-level score of 7 out of 10 and a confidence rating of 74 percent. The activity frequency is relatively low at 3 out of 10, suggesting periodic rather than continuous engagement, yet the sustained reporting window spanning approximately eight months indicates persistent rather than opportunistic behavior. The concentration of reports within cloud infrastructure is notable because compromised cloud instances are frequently leveraged as jumping-off points for further attacks, enabling actors to anonymize their origin while benefiting from the reputation of a trusted hosting provider.
The dominant threat category recorded against this IP involves general hacking activity, which encompasses unauthorized access attempts, exploitation of vulnerable services, and probing for entry points into target systems. This pattern suggests the address may be scanning or brute-forcing exposed services such as SSH, RDP, or web applications. While a 3/10 activity frequency indicates bursts of engagement rather than constant assault, each successful intrusion could grant persistent access to downstream systems, making this address a credible threat to any openly accessible service.
Site operators should immediately block or heavily rate-limit connections from this address at the network perimeter firewall level. Implementing fail2ban or equivalent log-based intrusion prevention tools can automatically detect and respond to repeated connection attempts from the same source. All exposed services should enforce strong, unique credentials and disable root or administrative access where possible. Continuous monitoring of authentication logs for source IP 147.185.133.148 is recommended, and any matching entries should trigger an immediate security review.
JP 
BE 
BG 
FR 
SG 
HK 
BD 
RU