Preventing malicious traffic from bc.googleusercontent.com

[Wanabo]

After my last post I wrote a cron script to retrieve and block googleusercontent ip's with CSF/LFD.

Add in /etc/csf/csf.blocklists (or use the CSF web ui)

GOOGLECLOUD|86400|0|https://domain.com/blocklists/bcgoogle-cloud_ips.txt

Use a domain you own or have access to. (If the blocklist isn't loaded afterwards by CSF, then check folder and file permissions)

create /etc/cron.daily/parse_bcgoogle-cloud.py and make it executable.

Contents of file:

#!/usr/bin/env python3

import json
import urllib.request
import subprocess
from pathlib import Path

URL = "https://www.gstatic.com/ipranges/cloud.json"

OUTPUT_PATH = Path(
    "/home/admin/domains/domain.com/public_html/blocklists/bcgoogle-cloud_ips.txt"
)

HEADERS = {
    "User-Agent": (
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
        "AppleWebKit/537.36 (KHTML, like Gecko) "
        "Chrome/120.0.0.0 Safari/537.36"
    )
}

try:
    req = urllib.request.Request(URL, headers=HEADERS)

    with urllib.request.urlopen(req, timeout=30) as response:
        data = json.loads(response.read().decode("utf-8"))

    ip_list = []

    for item in data.get("prefixes", []):
        ip = item.get("ipv4Prefix") or item.get("ipv6Prefix")
        if ip:
            ip_list.append(ip)

    # Remove duplicates and sort for consistent output
    ip_list = sorted(set(ip_list))

    new_content = "\n".join(ip_list) + "\n"

    # Read existing content if the file exists
    if OUTPUT_PATH.exists():
        old_content = OUTPUT_PATH.read_text()
    else:
        old_content = ""

    # Only update when something changed
    if new_content != old_content:

        OUTPUT_PATH.write_text(new_content)

        print(
            f"Updated {len(ip_list)} unique Google-cloud IPs/CIDRs "
            f"in {OUTPUT_PATH}"
        )

    else:
        print("No changes detected.")

except subprocess.CalledProcessError as e:
    print(f"Failed to restart CSF/LFD: {e}")

except Exception as e:
    print(f"Error processing IP list: {e}")

Originally I restarted CSF with this script, but realized this was not necessary, because CSF will read the blocklist automatically according to the settings in

GOOGLECLOUD|86400|0|https://domain.com/blocklists/bcgoogle-cloud_ips.txt

So this is leftover code (I left it as is, because I have to test if the script still works without) :

except subprocess.CalledProcessError as e:
    print(f"Failed to restart CSF/LFD: {e}")

But as lazy as I am, I thought hey my script is working so why spend energy in optimizing as I am not a very good coder. And yes I had help from AI.

After setting this up execute ./parse_bcgoogle-cloud.py and check if https://domain.com/blocklists/bcgoogle-cloud_ips.txt is created, if not check file and folder permissions and execute again.

Then execute csf -ra and check in /var/lib/csf if csf.block.GOOGLECLOUD is created

If you have improvements or suggestions, you're welcome to share.

 

[Wanabo]

Sure you don't need this one?

https://www.gstatic.com/ipranges/cloud.json

These are the (dynamic) google cloud customer ipranges

Thanks for the link, I used it in my script.

Did some testing. It is safe to remove:

import subprocess

and

except subprocess.CalledProcessError as e:
    print(f"Failed to restart CSF/LFD: {e}")