Extreme Threat
IP 34.22.172.118 is a critical-risk address operating from Google LLC's infrastructure in Belgium (ASN AS396982), generating 321 abuse reports across 20 automated honeypot sensors between March and June 2026 with a threat level rating of 10/10 and a confidence score of 94%. This IP represents a compromised system being weaponized for distributed cyber intrusion campaigns, predominantly engaging in general hacking activity, malware propagation, and web application probing against exposed services worldwide.
The volume and consistency of reports for this address are particularly concerning. With 321 reports sourced from 20 distinct automated honeypot sensors, the detection landscape confirms sustained, multi-vector hostile activity spanning approximately three months. The dominant threat category — Hacking, accounting for 19 of the categorized reports — encompasses intrusion attempts, vulnerability exploitation, and unauthorized access probes. An additional 2 reports classify this IP as an Exploited Host, indicating the address likely belongs to a compromised system being remotely controlled by threat actors without the owner's knowledge. The remaining reports document Web App Attack activity, specifically targeting application-layer vulnerabilities. Observed attack patterns consistently reference attack connections, malware/exploit activity, and web application reconnaissance, suggesting this host participates in coordinated scanning and exploitation workflows.
For network operators, the practical risk is clear: an IP originating from a legitimate cloud provider's address space can bypass naive allowlist filters that trust major cloud operators. The dual classification as both an attacking infrastructure node and a potential exploited host means this address may simultaneously serve as an attack source and as a compromised endpoint being misused by external actors. The high activity frequency score of 8/10 further indicates persistent rather than intermittent malicious intent, making this a reliable candidate for blocking at network perimeter devices such as firewalls, intrusion prevention systems, or web application firewalls.
Site operators should immediately block 34.22.172.118 at the network boundary and implement fail2ban or equivalent dynamic blocking tools to automatically respond to repeated connection attempts matching known attack signatures. Organizations running exposed services should enforce strong authentication controls, particularly on administrative interfaces, and ensure all software is actively patched against known exploitation vectors. Regular security audits of web-facing applications will help identify vulnerabilities that attack patterns associated with this IP may attempt to exploit. Finally, consider filing an abuse report with Google LLC referencing AS396982 to alert the network operator to the compromised infrastructure within their network block.
JP 
MU 
KR 
NG 
FR 
HK