Maximum Danger
IP 35.205.166.64 is a critical-risk address operated by Google LLC (AS396982) that has accumulated 175 abuse reports across approximately three months of observed activity, representing a sustained and dangerous threat to internet-connected infrastructure. With a perfect threat level rating of 10/10 and a 94% confidence score, this Belgian-hosted IP demands immediate defensive attention from any organization with exposed services.
Detection data compiled from 20 automated honeypot sensors reveals sustained hostile activity originating from 35.205.166.64 between March and May 2026. The dominant threat category recorded is general hacking activity (19 reports), supplemented by single reports of exploited host behavior and IoT targeting. Network traffic analysis confirms the use of the SMBv1 protocol in attack connections, a legacy protocol with well-documented remote-code-execution vulnerabilities that remains a favourite entry point for threat actors deploying ransomware and conducting lateral movement. Despite a moderate raw activity frequency score of 3/10, the report volume and diversity of techniques indicate methodical, automated exploitation rather than opportunistic probing.
The confirmed SMBv1 exploit activity means this IP is actively scanning for vulnerable Windows hosts and attempting to deliver malware or establish persistent footholds across unpatched systems. The parallel IoT targeting activity suggests simultaneous reconnaissance of smart devices, cameras, and routers with weak security configurations, potentially building capabilities for a coordinated botnet or data exfiltration campaign. The presence of exploited-host classification in the reports raises the additional concern that this address may be running attack tooling from a compromised Google Cloud instance, meaning the legitimate infrastructure owner may be unaware their resource is weaponised.
Network administrators should block 35.205.166.64 at the perimeter firewall or edge router immediately and implement automated blocking via intrusion-prevention tools such as fail2ban to handle ongoing retry attempts. All exposed Windows hosts must be audited for SMBv1 usage and the protocol disabled unless strictly required, with priority given to applying the latest security patches. IoT and networked device administrators should verify firmware currency, replace default credentials, and isolate smart devices on dedicated network segments away from sensitive systems. Organizations hosting services in Google Cloud should audit their internal tooling and monitor for signs of compromise or unauthorized outbound scanning originating from their allocated IP ranges.
JP 
ES 
AE 
HK 
GB 
FR 
AU 
ID