Extreme Threat
IP 34.79.177.120 is a high-risk address operating from Google LLC's infrastructure in Belgium, with a threat level of 10/10 and a confidence score of 94 percent based on 352 total reports sourced from 20 automated honeypot sensors. The dominant activity involves hacking intrusions and exploited-host behaviour, indicating that this IP is actively conducting targeted attacks against exposed services rather than passively scanning.
The IP was first reported in March 2026 and most recently in June 2026, with an activity frequency rated 8 out of 10, suggesting persistent and repeated malicious engagement over a three-month window. The report breakdown shows Hacking as the leading category at 16 reports, followed by Exploited Host at 5 reports and a single Web App Attack report. Abstracted attack-pattern notes reference web app probing, malware and exploit activity, and repeated attack connections, pointing to a multi-vector offensive posture rather than a single opportunistic attempt.
The concentration of Hacking and Exploited Host classifications is significant because it suggests the address may be running automated attack tooling while simultaneously exhibiting signs of compromised-host behaviour, meaning it could be part of a botnet or rented attack infrastructure. Web App Attack activity reinforces that exposed HTTP and HTTPS services are a direct target, with probes targeting known vulnerability classes including injection and file-inclusion vectors. The operational concentration in a major cloud provider's ASN makes this address particularly dangerous, as its traffic may appear legitimate to basic allowlist filters.
Site operators should block IP 34.79.177.120 at the network perimeter and implement fail2ban or equivalent dynamic firewall rules to auto-drop repeated connection attempts. Exposed web applications should be placed behind a Web Application Firewall with rule sets tuned to OWASP Top 10 threats, and all software should be kept current with security patches. Monitoring inbound connection logs for the patterns described above will help identify whether any probing has progressed to successful exploitation. Organizations running services in or near Belgian cloud infrastructure should treat this address as a confirmed threat and review access controls accordingly.
JP 
BG 
CA 
TW 
VN 
KR