Significant Threat
IP 205.210.31.239 is a high-risk address operating from Google Cloud Platform infrastructure within the United States, with a threat level of 8 out of 10 based on 175 abuse reports logged by automated honeypot sensors between August 2025 and June 2026. The dominant activity involves general hacking activity including intrusion attempts and exploitation probing, alongside targeted reconnaissance against IoT and connected devices.
The IP has accumulated 175 reports across a ten-month period, yielding an activity frequency rating of 6 out of 10 and a confidence score of 80 percent regarding its malicious intent. Detection was entirely automated through honeypot sensors, with 20 separate instances flagging hacking-related patterns and one report noting IoT-targeted behavior. The network is registered to AS396982, which belongs to Google Cloud Platform, a major public cloud provider frequently abused by threat actors to mask their origin. TCP stream anomalies detected by intrusion analysis systems suggest the address is conducting automated scanning and connection probing against exposed services.
The SURICATA STREAM packet anomaly detected from this address indicates malformed or deliberately fragmented TCP acknowledgements commonly used during reconnaissance and vulnerability scanning campaigns. Such behavior allows attackers to map firewall rules, identify open ports, and test response patterns from potential targets. The combination of general intrusion probing with IoT-specific targeting suggests this infrastructure is being used for broad reconnaissance campaigns that also prioritise weakly-secured connected devices such as cameras, routers, and smart appliances commonly found on residential and enterprise networks.
Site operators should block or rate-limit traffic from this IP address at the firewall or load-balancer level, particularly on exposed management interfaces and non-standard ports. Implementing strict ingress filtering and monitoring for unusual TCP stream behaviour can help detect and mitigate probing attempts in real time. Deploying automated defensive tools such as fail2ban to dynamically ban repeat offenders, enforcing strong authentication on all externally accessible services, and maintaining regular security patching cycles will significantly reduce exposure to the intrusion techniques this address is known to employ.
JP 
BE 
CL 
KR 
EG 
SG