Critical Threat
IP address 35.233.42.65, allocated to Google LLC under ASN AS396982 in Belgium, is classified as a critical-risk address with a threat level of 10/10. This IP has accumulated 211 abuse reports from automated honeypot sensors, with a confidence score of 94% and an activity frequency rated 8/10, indicating sustained, aggressive malicious behaviour over its active period between March 2026 and May 2026.
Analysis of the reported threat categories reveals that Hacking activity dominates the reports, accompanied by Exploited Host indicators and Web Application Attack signatures. The 20 distinct detection sources across automated honeypot infrastructure consistently flagged this address for connection attempts, malware or exploit activity, and web application probing. The 211 total reports over a compressed timeframe, combined with the 94% confidence rating, suggest that this is not isolated or accidental scanning but rather persistent, targeted hostile activity originating from or through this IP address.
The dominant Hacking category encompasses intrusion attempts, exploitation of vulnerabilities, and unauthorized access probes. The presence of Exploited Host signals indicates that the infrastructure associated with this address may itself be compromised and weaponised without the owner's knowledge, functioning as an attack platform. Web Application Attack signatures suggest the IP is actively probing for weaknesses such as injection flaws, authentication bypasses, or other vulnerabilities in publicly accessible web services. Together, these patterns represent a concrete risk to any exposed service accepting connections from this address, particularly SSH, RDP, or web-facing application endpoints.
Site operators should block 35.233.42.65 at the network perimeter or firewall level without delay. Implement strict rate-limiting on authentication endpoints and enforce strong, multi-factor authentication for all remote access services. Keep all systems and web applications patched and updated, and consider deploying a web application firewall to mitigate probing attempts. Monitoring tools such as fail2ban can automate the detection and blocking of repeated connection patterns associated with this IP. If the IP is observed persistently targeting infrastructure, consider reporting the activity to the AS396982 operator to assist in identifying and remediating any compromised host.
JP 
TW 
GB 
AU 
FI 
RO 
SC 
NL