Severe Risk
IP 146.148.26.145 is a critical-risk address hosted within Google Cloud Platform infrastructure in Belgium, flagged by automated honeypot sensors with a 98% confidence rating based on 229 independent abuse reports filed over approximately six months between August 2025 and February 2026. The overwhelming majority of detections classify the observed activity as general hacking intrusion attempts, with a smaller subset indicating the address may function as an exploited host being weaponised without its operator's knowledge.
The volume and consistency of reporting paint a clear picture of persistent hostile reconnaissance and exploitation activity. Twenty separate automated honeypot sensors distributed across the security community collectively logged these 229 incidents, yielding an activity frequency rating of 8 out of 10 and a threat score of 10 out of 10. The AS396982 network allocation to Google Cloud Platform means this address operates from a major cloud provider commonly targeted by threat actors seeking flexible, reputably trusted infrastructure for launching attacks while obscuring their true origin. The Belgian geographic assignment aligns with the EU-based hosting environment frequently abused for such campaigns.
The dominant "Hacking" classification encompasses automated vulnerability probing, intrusion attempts, and exploitation of insecurely configured services exposed to the internet. When combined with the "Exploited Host" designation, these reports suggest this Google Cloud IP is actively engaged in scanning and attacking external targets while potentially also serving as a compromised pivot point for further malicious operations. The real-world risk to any publicly accessible service reachable from this address is significant: exposed SSH, RDP, web applications, or unpatched services face repeated automated exploitation attempts that could culminate in unauthorised access or malware delivery.
Site operators should treat IP 146.148.26.145 as definitively hostile and block it at the network perimeter or firewall level without deliberation. Implementing fail2ban, CrowdSec, or similar dynamic blocking tools that automatically respond to repeated hostile connection patterns provides layered protection against the scanning behaviour this address demonstrates. Maintaining rigorous patch management for all internet-facing services, enforcing strong authentication on remote access mechanisms, and deploying intrusion detection systems to log and alert on exploitation signatures will further reduce exposure to the intrusion techniques this actor employs.
JP 
GB 
TW 
RO 
BG 
AR 
KR 
AU