A 90-Day Google Cloud Attack Telemetry Study: 303 IPs and 2,615 Malicious Requests

Abstract

This study empirically examines distributed security scanning and exploitation attempts directed at public web infrastructure. Observed categories include credential discovery, SSH private-key discovery, AWS/GCP metadata SSRF, command-injection probes, process-environment probing, wp-config discovery, and configuration/backup-file reconnaissance.

Attribution and methodological limitations

An address falling within a Google Cloud published prefix does not imply that Google itself generated the traffic. The finding establishes only that the observed source address matched Google Cloud address space at verification time. No attribution is made to the ultimate operator of the VM, account or project.

User-Agent strings are not treated as identity evidence. Several sources presented unrelated crawler identities in rotation. Classification therefore relies on source IP, timestamp, HTTP method, request URI and behavioral attack signatures.

Likewise, an HTTP 200 response is not interpreted by itself as proof of successful exploitation or disclosure. This research documents observed probing and exploitation attempts.

Methodology

Apache/Nginx access telemetry was analyzed across a 90-day observation window. Requests were classified into sensitive-file discovery, metadata SSRF, command injection, credential/key discovery, filesystem traversal and configuration reconnaissance categories. Address ownership was verified against Google's official https://www.gstatic.com/ipranges/cloud.json publication.

Principal attack classes

• Cloud metadata SSRF: attempts targeting 169.254.169.254 and related metadata services.
• Credential discovery: AWS/GCP/OCI credential and service-account paths.
• Private-key discovery: SSH private-key and related key-material paths.
• Command injection: shell metacharacters in cmd, exec, host and command-style parameters.
• Process/environment discovery: /proc/self/environ and application environment files.
• Configuration/backup discovery: wp-config, .env, YAML/JSON/TOML and backup variants.

High-volume case study: 34.79.187.104

This source matched Google Cloud prefix 34.76.0.0/14 in europe-west1. Of 534 observed requests, 162 matched attack signatures. The same source exhibited metadata SSRF, command injection, AWS credential discovery, service-account discovery, SSH private-key discovery, wp-config probing and process-environment reconnaissance.

Appendix A — Complete list of 303 verified source IPs

The table below contains every source address included in the verified Google Cloud research dataset. It represents network telemetry, not an allegation against a person or organization.

Appendix B — Raw HTTP request evidence

The sections below are grouped by source IP. Only records for which a complete timestamp, target, HTTP method and request URI could be reconstructed are published as raw HTTP evidence. Internal server log paths and unnecessary internal metadata are intentionally omitted.

Published complete HTTP request tuples: 2130