The Google Cloud Anomaly

Geographic Distribution — Where the Abuse Lives

Belgium's europe-west1 cluster has a 73% abuse rate. That means nearly three out of four GCP instances we've tracked in St-Ghislain are reported at the maximum abuse confidence score. The US cluster — where Google's primary infrastructure lives — has a 25% rate. The same company, the same policies, the same abuse team. The difference is geographic.

Highest-Threat GCP IPs

The highest-threat IP (35.188.112.111, threat=88) sits in three simultaneous campaigns: hassh-03a80b21afa81068, hassh-af8223ac9914f509, and hassh-f555226df1963d1d. GreyNoise classifies it as malicious. This is a Google Cloud IP address, belonging to the company that literally invented cloud security best practices, running in three botnets at once.

Campaign Activity in the Belgium Cluster

The Belgian cluster doesn't just have high abuse scores — it's organized. Multiple coordinated campaigns operate from St-Ghislain:

The Belgian "triad" — campaigns a20aced7, b4b8ae3d, and e788c657 — share extensive membership overlap. IPs like 34.14.51.14 appear in all three plus two more, making it a member of five simultaneous campaigns. This isn't random abuse. This is coordinated infrastructure operating from Google's flagship European data center.

The Contabo Campaign Appears on Google Cloud

In 032F, we identified campaign hassh-16443846184eafde as provider-specific — appearing almost exclusively on Contabo AS51167. But there's an exception: 34.138.135.178 (US, threat=52) — a Google Cloud IP — also belongs to this campaign.

This cross-provider contamination suggests one of two things: either the same botnet operator has accounts on both Contabo and GCP, or the campaign's tooling was developed on one provider and ported to another. Either way, it invalidates the notion that campaigns respect provider boundaries. A €4.99/month Contabo VPS and a $XXX/month GCP instance running the same botnet client.

The GCAT Paradox

Google's Cybersecurity Action Team (GCAT) has published multiple Threat Horizons reports documenting exactly the problem we observe:

• 86% of compromised GCP instances are used for cryptocurrency mining (GCAT 2021)
• Attack-to-install takes <22 seconds — automated scanning tools compromise and deploy mining software faster than any human response
• $53 of victim compute cost per $1 of attacker mining profit — the economics are asymmetrically destructive
• The H1 2026 Threat Horizons report documents UNC4899 exploiting cluster admin privileges for container escape

Google knows its infrastructure is weaponized. Google publishes papers about it. Google employs what is arguably the world's largest private-sector threat intelligence team. And yet: 157 IPs in our database, 77 at maximum abuse confidence, 74 concentrated in a single Belgian data center running coordinated campaigns.

Why Belgium, Not the US?

The 2.3× threat multiplier between Belgium (44.9) and US (19.6) demands explanation. Several hypotheses:

1. Regulatory arbitrage: US-based GCP abuse teams may prioritize US IP space. European instances process through different workflows, slower response times.
2. Verification gaps: Account creation for europe-west1 may have different KYC requirements or payment verification chains than us-east1/us-central1.
3. Customer mix: European GCP customers skew toward startups and SMBs using free-tier credits — the same credits that attackers exploit with stolen or synthetic identities.
4. Transit advantage: Belgium's position as a European internet hub means a compromised instance in St-Ghislain can reach more European targets with lower latency than one in Iowa.

None of these hypotheses excuses the disparity. They explain the mechanism. The policy failure is Google's to own.

Google Cloud in the Dossier Corpus

This is not Google's first appearance in our investigations:

• TI-019E / TI-019F: GCP IPs linked to modzmodz and Outlaw botnet behavior, including Meow and brute-force tooling
• TI-019B: GCP SSH scanning/brute-force infrastructure identified, including 34.22.169.226 (Belgium, threat=68)
• TI-004: Multiple GCP IPs identified as scanning/fingerprinting nodes: 34.132.194.42, 35.188.112.111, 35.237.94.18
• 019M: Google's own GCAT report cross-referenced with honeypot data confirming cloud abuse via compromised instances

Across four prior investigations and now this letter, the pattern is consistent: Google Cloud appears repeatedly as attack infrastructure. Not one compromised instance — a systemic and recurring problem across regions and campaigns.

Reading Between the Lines

Q: Does Google benefit from abuse on its platform?

A: Directly, in revenue terms, yes. Every VM instance — whether used for legitimate workloads or botnet operations — generates compute charges. Google's $300B+ annual revenue doesn't distinguish between a machine learning training job and a cryptocurrency mining operation on the billing statement. The detection of abuse is a cost center. The hosting of abuse is a revenue line. The economic incentive is structurally misaligned.

Q: Why does Belgium have 2.3× the threat rate of the US?

A: The official explanation would invoke customer mix, automated detection latency, and regional team capacity. The structural explanation is more troubling: Belgium is Google's European beachhead. It's where free-tier credits, startup programs, and aggressive customer acquisition create the lowest-friction path to cloud resources in the EU. Low friction for legitimate users is also low friction for abuse. The belgium cluster isn't a bug — it's a feature of growth-at-all-costs cloud economics applied to a European market.

Q: Why does Google publish Threat Horizons reports about problems it doesn't solve?

A: The reports serve multiple purposes simultaneously. They demonstrate "awareness" to regulators (we know about this, look how transparent we are). They shift responsibility to customers (secure your instances, follow our recommendations). They position Google as a thought leader in cloud security (buy our security products to protect the infrastructure we failed to protect). The reports are simultaneously confession and marketing material. The 86% crypto-mining statistic is presented as industry intelligence, not as an indictment of Google's own platform security.

Q: Is the Belgium cluster a coordinated operation or organic abuse?

A: The campaign data strongly suggests coordination. The "Belgian triad" (campaigns a20aced7, b4b8ae3d, e788c657) shares extensive membership overlap, with IPs appearing in 3-5 campaigns simultaneously. This is not random customers accidentally leaving SSH ports open. This is systematic provisioning of GCP instances in europe-west1 for the specific purpose of SSH brute-force campaigns. Whether it's one operator with multiple accounts or a shared tooling ecosystem, the result is the same: a hyperscaler's flagship European data center functioning as botnet infrastructure.

Q: Does Google's intelligence apparatus (TAG, Mandiant, VirusTotal) actually look inward?

A: Google's Threat Analysis Group tracks nation-state actors. Mandiant does incident response for Fortune 500 companies. VirusTotal analyzes 2 million files per day. Project Zero finds zero-day vulnerabilities in other people's software. But the SSH brute-force botnets in St-Ghislain aren't sophisticated enough to warrant their attention. They're noisy, automated, and entirely commodity. The irony is complete: Google has built the world's most capable threat intelligence organization, and it's pointed outward. The threats inside Google's own network are too boring to investigate.