<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jun 2, 2022 at 12:22 PM John Von Essen <<a href="mailto:john@essenz.com">john@essenz.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Feel free to contact me off-list if your associated with Google Fi.<br>
<br>
I’m trying to narrow down some IP abuse that I believe is coming from Google Fi mobile devices. The IPs are all coming up as generic Google LLC in whois, and they dont have any reverse DNS. I’m trying to see how I can confirm that these are IPs related to the Google Fi service/network, or just random Google Clould IPs<br>
<br>
Here are some sample IPs:<br>
<br>
35.187.133.202<br>
35.187.133.204<br>
35.187.133.200<br>
34.116.22.76<br>
34.116.22.74<br>
34.116.22.72<br>
107.178.194.231<br>
107.178.194.233<br>
107.178.194.235<br>
107.178.193.10<br>
107.178.193.12<br>
<br></blockquote><div><br></div><div>all of these are very clearly marked out in whois as google-cloud ips:</div><div>NetRange: 35.184.0.0 - 35.191.255.255<br>CIDR: <a href="http://35.184.0.0/13">35.184.0.0/13</a><br>NetName: GOOGLE-CLOUD<br></div><div><br></div><div>NetRange: 34.64.0.0 - 34.127.255.255</div><div>CIDR: <a href="http://34.64.0.0/10">34.64.0.0/10</a><br>NetName: GOOGL-2<br></div><div><br></div><div>NetRange: 107.178.192.0 - 107.178.255.255<br>CIDR: <a href="http://107.178.192.0/18">107.178.192.0/18</a><br>NetName: GOOGLE-CLOUD<br></div><div><br></div><div>$ for d in $(cat /tmp/x); do host $d; done<br>Host 202.133.187.35.in-addr.arpa not found: 2(SERVFAIL)<br>Host 204.133.187.35.in-addr.arpa not found: 2(SERVFAIL)<br>Host 200.133.187.35.in-addr.arpa not found: 2(SERVFAIL)<br>Host 76.22.116.34.in-addr.arpa not found: 2(SERVFAIL)<br>Host 74.22.116.34.in-addr.arpa not found: 2(SERVFAIL)<br>Host 72.22.116.34.in-addr.arpa not found: 2(SERVFAIL)<br>231.194.178.107.in-addr.arpa domain name pointer <a href="http://231.194.178.107.gae.googleusercontent.com">231.194.178.107.gae.googleusercontent.com</a>.<br>233.194.178.107.in-addr.arpa domain name pointer <a href="http://233.194.178.107.gae.googleusercontent.com">233.194.178.107.gae.googleusercontent.com</a>.<br>235.194.178.107.in-addr.arpa domain name pointer <a href="http://235.194.178.107.gae.googleusercontent.com">235.194.178.107.gae.googleusercontent.com</a>.<br>10.193.178.107.in-addr.arpa domain name pointer <a href="http://10.193.178.107.gae.googleusercontent.com">10.193.178.107.gae.googleusercontent.com</a>.<br>12.193.178.107.in-addr.arpa domain name pointer <a href="http://12.193.178.107.gae.googleusercontent.com">12.193.178.107.gae.googleusercontent.com</a>.<br></div><div><br></div><div>I'll see about fixing the missing ptrs... but... 'it's all cloud man!'</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Thanks<br>
John<br>
<br>
</blockquote></div></div>