Elevated Risk
IP 198.235.24.178 is a critical-risk address that has generated 467 independent abuse reports and represents an active, persistent threat to internet-facing infrastructure. Operating from Google Cloud Platform (AS396982) in the United States, this IP has maintained a high activity frequency of 8/10 over approximately nine months, with its most recent hostile behavior recorded in May 2026. The dominant threat classification is general hacking activity, encompassing unauthorized access attempts and exploitation probes against exposed services.
Automated honeypot sensors across multiple monitoring points documented 467 distinct attack incidents attributed to this single source between August 2025 and May 2026. The consistent volume of reports — sourced exclusively from automated honeypot infrastructure rather than organic community filings — indicates systematic, automated scanning behavior rather than opportunistic opportunism. Network-level analysis reveals TCP stream anomalies, specifically broken acknowledgment patterns flagged by intrusion-detection signatures, suggesting the delivery of malformed packets designed to provoke unexpected application responses or evade filtering rules.
Hacking activity of this profile typically precedes more targeted exploitation campaigns, where threat actors systematically probe perimeter defenses to identify unpatched services or misconfigured authentication mechanisms. The broken ACK pattern observed is consistent with techniques used to circumvent stateful firewalls or conduct reconnaissance on TCP handshake behavior. For organizations running SSH, RDP or web-facing applications without robust hardening, such traffic represents a credible intrusion vector with potential for credential compromise, data exfiltration or lateral movement within compromised environments.
Network defenders should immediately block or aggressively rate-limit traffic from 198.235.24.178 at the firewall or network edge. Deploying intrusion-prevention rules tuned to detect malformed TCP payloads will mitigate the specific stream anomaly signature observed. Enforcing key-based authentication for remote-access services, implementing fail2ban or equivalent dynamic blocking tools, and maintaining strict patch cadences for internet-facing software will substantially reduce susceptibility to the intrusion patterns this IP has demonstrated.
JP 
BE 
GB 
TH