Maximum Danger
IP 35.203.210.70 is a critical-risk address linked to 861 confirmed hacking intrusion attempts detected over a six-month window between December 2025 and May 2026, originating from Google Cloud Platform infrastructure in the United Kingdom.
The address, which routes through AS396982 operated by Google Cloud Platform, generated 861 abuse reports sourced exclusively from automated honeypot sensors, yielding a 69% confidence score. With a threat level rated 10/10 and an activity frequency of 4/10, the pattern spans from late 2025 into mid-2026, indicating sustained rather than opportunistic engagement. All 861 reports consistently categorize the activity as hacking, suggesting focused exploitation attempts rather than generalized reconnaissance or scanning. The United Kingdom geographic tag and cloud infrastructure context provide relevant network intelligence for organizations evaluating IP reputation and potential false-positive risks in their detection systems.
The sustained hacking activity documented against this IP reflects systematic unauthorized access attempts and vulnerability exploitation targeting exposed services, a pattern that automated honeypot sensors are specifically designed to capture and catalog. The volume of reports indicates either automated exploitation toolchains or repeated manual intrusion efforts against a consistent target set. Real-world risk includes potential credential compromise, data exfiltration from unpatched systems, and lateral movement within networks where initial access is achieved. Organizations with exposed SSH, RDP, web applications, or other network services represent the primary attack surface for this category of threat actor behavior.
Site operators should immediately block or closely monitor traffic from this IP address at the network perimeter and implement aggressive rate-limiting on any externally facing authentication endpoints. Deploying intrusion detection signatures and maintaining current patch management across all exposed systems significantly reduces the attack surface that this category of threat actor seeks to exploit. Security teams may also consider employing automated abuse-handling tools such as fail2ban to dynamically block repeated connection attempts matching the observed attack pattern.
JP 
BE 
TW 
FR 
HK 
PE 
CH 
PH