Preventing malicious traffic from bc.googleusercontent.com

[Remco00]

Lately I have seen an increasing number of malicious traffic from bc.googleusercontent.com in the log files. Almost always starting with the IP4 addresses 34.* and 35.*. That's why I went looking for an overview of IP addresses managed by Google. I found this one here:

https://www.gstatic.com/ipranges/goog.json

After stripping unnecessary text, I copied this list of Google IP-ranges to csf.deny:

# Google IP ranges
tcp|in|d=80,443|s=34.0.0.0/15
tcp|in|d=80,443|s=34.2.0.0/16
tcp|in|d=80,443|s=34.3.0.0/23
tcp|in|d=80,443|s=34.3.3.0/24
tcp|in|d=80,443|s=34.3.4.0/24
tcp|in|d=80,443|s=34.3.8.0/21
tcp|in|d=80,443|s=34.3.16.0/20
tcp|in|d=80,443|s=34.3.32.0/19
tcp|in|d=80,443|s=34.3.64.0/18
tcp|in|d=80,443|s=34.4.0.0/14
tcp|in|d=80,443|s=34.8.0.0/13
tcp|in|d=80,443|s=34.16.0.0/12
tcp|in|d=80,443|s=34.32.0.0/11
tcp|in|d=80,443|s=34.64.0.0/10
tcp|in|d=80,443|s=34.128.0.0/10
tcp|in|d=80,443|s=35.184.0.0/13
tcp|in|d=80,443|s=35.192.0.0/14
tcp|in|d=80,443|s=35.196.0.0/15
tcp|in|d=80,443|s=35.198.0.0/16
tcp|in|d=80,443|s=35.199.0.0/17
tcp|in|d=80,443|s=35.199.128.0/18
tcp|in|d=80,443|s=35.200.0.0/13
tcp|in|d=80,443|s=35.208.0.0/12
tcp|in|d=80,443|s=35.224.0.0/12
tcp|in|d=80,443|s=35.240.0.0/13
tcp|in|d=80,443|s=35.252.0.0/14

Now, after a few days, no more malicious traffic entries (e.g. mod_security) from bc.googleusercontent.com are visible in the log files. In the coming period I will monitor the Google Json file for the frequency of mutations in the file. If necessary, I will supplement my findings here.

List edited with advanced port filtering and specialized pipe-separated rules

 

[adam12]

I've been seeing the same, and was contemplating the exact same action.

Unfortunately I am a little worried about blocking legitimate traffic, so I was hoping GCP would figure out who's churning through their addresses.

 

[Richard G]

You might want to have a look at this thread. It's set as solved but was a bit ongoing.
I also experiencing again spam via Google and Outlook.

Solved Thread 'How can I block this spam coming via Google?'

Mar 16, 2026

Lately our customers are getting a lot of spam. Problem is that we can not block it the normal way, as they are coming via Google.
We report every instance, but they keep coming, it looks like this:

eceived: from server.mycompany.nl
    by server.mycompany.nl with LMTP
    id oRgGHvZkt2lEAwsAugeUdg
    (envelope-from <[email protected]>)
    for <[email protected]>; Mon, 16 Mar 2026 03:03:34 +0100
Received: from mail-oa1-x45.google.com ([2001:4860:4864:20::45])
    by server.mycompany.nl with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
    (Exim 4.99.1)...

• Richard G
• Replies: 76
• Forum: E-Mail

 

[Remco00]

You might want to have a look at this thread. It's set as solved but was a bit ongoing.
I also experiencing again spam via Google and Outlook.

Solved Thread 'How can I block this spam coming via Google?'

Mar 16, 2026

Lately our customers are getting a lot of spam. Problem is that we can not block it the normal way, as they are coming via Google.
We report every instance, but they keep coming, it looks like this:

eceived: from server.mycompany.nl
    by server.mycompany.nl with LMTP
    id oRgGHvZkt2lEAwsAugeUdg
    (envelope-from <[email protected]>)
    for <[email protected]>; Mon, 16 Mar 2026 03:03:34 +0100
Received: from mail-oa1-x45.google.com ([2001:4860:4864:20::45])
    by server.mycompany.nl with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
    (Exim 4.99.1)...

• Richard G
• Replies: 76
• Forum: E-Mail

Thanks Richard, but this has nothing to do with receiving spam. The malicious traffic we receive from bc.googleusercontent.com triggers certain mod_security rules we want to get rid of. Meanwhile I edited my first post to include port filtering and specialized pipe-separated rules in the list with Google IP-ranges so only ports 80 and 443 are blocked.

 

[sysdev]

Sure you don't need this one?

https://www.gstatic.com/ipranges/cloud.json

These are the (dynamic) google cloud customer ipranges

 

[Richard G]

These are the (dynamic) google cloud customer ipranges

Is there an easy way to implement this in CSF? Or Spamassassin?

 

[sysdev]

Is there an easy way to implement this in CSF? Or Spamassassin?

Sure, parse te json and drop the ips in /etc/csf/csf.deny, restart csf.

 

[zEitEr]

Why not to use this one then https://www.gstatic.com/ipranges/goog.txt ?

 

[Remco00]

Why not to use this one then https://www.gstatic.com/ipranges/goog.txt ?

Thx, saves me a grep command

 

[Richard G]

Why not to use this one then

But those also are only the googleusercontent ip's? Or all google ip's? Because we wouldn't want to blok google mail itself for example and notices from adsense.

 

[zEitEr]

But those also are only the googleusercontent ip's? Or all google ip's?

All google's IPs

 

[Richard G]

Then it would be unusable if one blocks all google ip's then gMail posts not not be able to be received either. In post #5 it's only Google cloud if I'm not mistaken.

 

[Remco00]

Therefore, we only block certain segments from the list which we recognize from the logs (see my first post #1) and only incoming ports 80 and 443.

 

[sysdev]

An easy way is something like:

# List whatever networks you want (this is goog.json minus the service ranges.
GCP="34.0.0.0/15 34.2.0.0/16 34.3.0.0/23 34.3.3.0/24 34.3.4.0/24 34.3.8.0/21 34.3.16.0/20 34.3.32.0/19 34.3.64.0/18 34.4.0.0/14 34.8.0.0/13 34.16.0.0/12 34.32.0.0/11 34.64.0.0/10 34.128.0.0/10"

# block 80/443. I just block everything because of the three musketeer rule: an a*hole at 443 is an a*hole at all ports, but this is a 2 port version. 
for c in $GCP; do
  for p in 80 443; do
    echo "tcp|in|d=$p|s=$c # GCP abuse"
  done
done >> /etc/csf/csf.deny
csf -r

More servers or many more ip's? Drop them in a ipset hash:net block.

 

[Richard G]

and only incoming ports 80 and 443.

Those googleusercontent ip's are also spam mails. So I would suggest to add port 25 for those who want.