On Thu, Jun 2, 2022 at 12:22 PM John Von Essen <john@essenz.com> wrote:

Feel free to contact me off-list if your associated with Google Fi.

I’m trying to narrow down some IP abuse that I believe is coming from Google Fi mobile devices. The IPs are all coming up as generic Google LLC in whois, and they dont have any reverse DNS. I’m trying to see how I can confirm that these are IPs related to the Google Fi service/network, or just random Google Clould IPs

Here are some sample IPs:

35.187.133.202
35.187.133.204
35.187.133.200
34.116.22.76
34.116.22.74
34.116.22.72
107.178.194.231
107.178.194.233
107.178.194.235
107.178.193.10
107.178.193.12

all of these are very clearly marked out in whois as google-cloud ips:

NetRange:       35.184.0.0 - 35.191.255.255
CIDR:           35.184.0.0/13
NetName:        GOOGLE-CLOUD

NetRange:       34.64.0.0 - 34.127.255.255

CIDR:           34.64.0.0/10
NetName:        GOOGL-2

NetRange:       107.178.192.0 - 107.178.255.255
CIDR:           107.178.192.0/18
NetName:        GOOGLE-CLOUD

$ for d in $(cat /tmp/x); do host $d; done
Host 202.133.187.35.in-addr.arpa not found: 2(SERVFAIL)
Host 204.133.187.35.in-addr.arpa not found: 2(SERVFAIL)
Host 200.133.187.35.in-addr.arpa not found: 2(SERVFAIL)
Host 76.22.116.34.in-addr.arpa not found: 2(SERVFAIL)
Host 74.22.116.34.in-addr.arpa not found: 2(SERVFAIL)
Host 72.22.116.34.in-addr.arpa not found: 2(SERVFAIL)
231.194.178.107.in-addr.arpa domain name pointer 231.194.178.107.gae.googleusercontent.com.
233.194.178.107.in-addr.arpa domain name pointer 233.194.178.107.gae.googleusercontent.com.
235.194.178.107.in-addr.arpa domain name pointer 235.194.178.107.gae.googleusercontent.com.
10.193.178.107.in-addr.arpa domain name pointer 10.193.178.107.gae.googleusercontent.com.
12.193.178.107.in-addr.arpa domain name pointer 12.193.178.107.gae.googleusercontent.com.

I'll see about fixing the missing ptrs... but... 'it's all cloud man!'

 

Thanks
John