Critical Alert
IP 205.210.31.78, registered to GOOGLE-CLOUD-PLATFORM under ASN AS396982 in the United States, presents a critical threat with a maximum threat level of 10/10 and a confidence score of 77%, supported by 262 total abuse reports from 20 automated honeypot sensors spanning August 2025 through May 2026. The overwhelming majority of recent threat reports categorize this address under hacking activity, with a smaller subset linked to exploited host behaviour, indicating that this IP is actively involved in intrusion attempts and may also serve as a compromised attack platform.
The detection volume is substantial, with 262 separate incident reports collected over approximately nine months, yielding a moderate activity frequency of 5/10 that suggests persistent rather than intermittent malicious intent. Suricata intrusion-detection signatures on honeypot sensors flagged this address specifically for SSH session establishment attempts on expected ports and stream-level anomalies indicative of exploit or malware activity. The combination of general attack connections, confirmed malware-related network traffic, and SSH brute-force signalling points to a host conducting widespread automated attacks against exposed services while simultaneously exhibiting signatures consistent with compromise and weaponisation.
Hacking activity of this nature poses a direct, immediate risk to any publicly accessible SSH or related service, as successful credential guessing or exploitation can grant adversaries persistent access, data exfiltration capability, or the ability to pivot further into a target network. The exploited-host classification further suggests that even if the originating system itself is not acting as a traditional attacker, its compromise means it may be co-opted into broader attack campaigns, amplifying the threat landscape. The presence of broken-ack stream anomalies frequently correlates with sophisticated malware designed to evade detection, meaning blocking this IP alone may not fully mitigate the risk if the underlying vulnerabilities enabling exploitation remain unpatched.
Site operators should immediately block IP 205.210.31.78 at the firewall or network edge, implement fail2ban or equivalent dynamic denial-of-service rules to auto-ban repeated authentication failures targeting SSH, and enforce key-based authentication with strong passphrase requirements to eliminate the effectiveness of brute-force campaigns. Regular patching of SSH daemons and associated software, coupled with intrusion-detection monitoring for anomalous SSH session behaviour and stream-level anomalies, will reduce the attack surface that this address and others like it attempt to exploit.
JP 
BE 
BG 
FR 
HK 
SE