Preventing malicious traffic from bc.googleusercontent.com

[Remco00]

Lately I have seen an increasing number of malicious traffic from bc.googleusercontent.com in the log files. Almost always starting with the IP4 addresses 34.* and 35.*. That's why I went looking for an overview of IP addresses managed by Google. I found this one here:

https://www.gstatic.com/ipranges/goog.json

After stripping unnecessary text, I copied this list of Google IP-ranges to csf.deny:

# Google IP ranges
34.0.0.0/15
34.2.0.0/16
34.3.0.0/23
34.3.3.0/24
34.3.4.0/24
34.3.8.0/21
34.3.16.0/20
34.3.32.0/19
34.3.64.0/18
34.4.0.0/14
34.8.0.0/13
34.16.0.0/12
34.32.0.0/11
34.64.0.0/10
34.128.0.0/10
35.184.0.0/13
35.192.0.0/14
35.196.0.0/15
35.198.0.0/16
35.199.0.0/17
35.199.128.0/18
35.200.0.0/13
35.208.0.0/12
35.224.0.0/12
35.240.0.0/13
35.252.0.0/14

Now, after a few days, no more malicious traffic entries (e.g. mod_security) from bc.googleusercontent.com are visible in the log files. In the coming period I will monitor the Google Json file for the frequency of mutations in the file. If necessary, I will supplement my findings here.

 

[adam12]

I've been seeing the same, and was contemplating the exact same action.

Unfortunately I am a little worried about blocking legitimate traffic, so I was hoping GCP would figure out who's churning through their addresses.

 

[Richard G]

You might want to have a look at this thread. It's set as solved but was a bit ongoing.
I also experiencing again spam via Google and Outlook.

Solved Thread 'How can I block this spam coming via Google?'

Mar 16, 2026

Lately our customers are getting a lot of spam. Problem is that we can not block it the normal way, as they are coming via Google.
We report every instance, but they keep coming, it looks like this:

eceived: from server.mycompany.nl
    by server.mycompany.nl with LMTP
    id oRgGHvZkt2lEAwsAugeUdg
    (envelope-from <[email protected]>)
    for <[email protected]>; Mon, 16 Mar 2026 03:03:34 +0100
Received: from mail-oa1-x45.google.com ([2001:4860:4864:20::45])
    by server.mycompany.nl with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
    (Exim 4.99.1)...

• Richard G
• Replies: 72
• Forum: E-Mail