Security Research
A 90-Day Google Cloud Attack Telemetry Study: 303 IPs and 2,615 Malicious Requests
A first-party 90-day web telemetry study covering 303 source IPs verified within Google Cloud address space, 22,078 HTTP requests, 2,615 attack-signature requests, and 2,130 timestamped raw HTTP evidence records. The study documents SSRF, credential discovery, SSH private-key discovery, command injection and sensitive-configuration reconnaissance.
Attribution note: presence within Google Cloud address space does not imply that Google itself generated the traffic. The study reports observed network sources and behavior.
Read research and raw evidenceDistributed Scanners Across Google Cloud: Crusader, AI/MCP and Credential-Discovery Activity
Research into 80 34.x/35.x source IPs, 65 Google Cloud matches across 23 regions, and multiple distinguishable distributed scanner fingerprints.
Read investigationInvestigating Crusader Worker 1.0: 91 IP Addresses, 20 Google Cloud Regions, and the Footprints of a Distributed Internet Scanner
A technical investigation of Crusader Worker 1.0 based on 91 source IPs, 674 Fail2Ban matches, 20 Google Cloud scopes and first-party telemetry.
Read investigation