Critical Alert
IP 34.38.195.167 is a critical-risk address operated by Google LLC in Belgium that has generated 291 abuse reports over a three-month window, with honeypot sensors flagging it primarily for hacking activity alongside exploited-host and web application attack signals. The IP, hosted within Google LLC's AS396982 infrastructure in Belgium, carries the maximum 10/10 threat level and a 93% confidence score, indicating that automated systems and community reporting are in strong agreement about its malicious intent. Across 20 distinct honeypot sources, this single address generated a substantial volume of incident reports between March 2026 and June 2026, placing its observed activity frequency at 6 out of 10 — consistent with sustained, repeated hostile scanning and connection attempts rather than isolated noise. Suricata sensors detected potentially unsafe SMBv1 protocol usage linked to malware or exploit activity, and ElasticPot probes confirmed targeted web application reconnaissance originating from this address. The co-occurrence of hacking, exploited-host, and web-app-attack categorisations within recent reports reinforces that this IP is almost certainly a compromised asset being weaponised by threat actors rather than a static entry point under direct attacker control.
The dominant hacking classification encompasses broad intrusion activity — port scanning, vulnerability probing, and exploit delivery attempts — while the exploited-host indicator signals that the compromised machine itself is being used as a launchpad for further attacks, likely without its owner's awareness. Web application attack signals point to structured probes targeting known vulnerabilities such as those in the OWASP Top 10, including potential file-inclusion or injection vectors detected by the honeypot instrumentation. The SMBv1 signature is particularly concerning because the legacy protocol is historically associated with ransomware delivery and lateral-movement tools such as EternalBlue, suggesting that this address may be participating in campaigns targeting internal network pivots or deploying secondary payloads. For any organisation exposing services to the internet, an IP generating this pattern of multi-vector reconnaissance from a cloud-hosted origin poses a concrete risk of credential compromise, service disruption, or initial access broker activity that feeds larger ransomware or data-exfiltration operations.
JP 
UZ 
ID 
UA 
LT