Security Research · 6 September 2026

Distributed Scanners Across Google Cloud: Crusader, AI/MCP and Credential-Discovery Activity

An analysis of 80 34.x/35.x sources observed in first-party server telemetry between September 1 and September 6, 2026, correlated with Google Cloud regions and behavioral scanner fingerprints.

Executive Summary

Suspicious traffic from 34.x or 35.x addresses can easily be mistaken for a single service, bot or scanning network. Our analysis of 80 unique 34.x/35.x source addresses revealed a considerably more complex picture.

The addresses were compared against Google's official 6 September 2026 cloud.json Google Cloud prefix snapshot. 65 of 80 addresses — 81.25% — matched Google Cloud customer-resource address space, while 15 did not.

This also demonstrates an important methodological point: a 34.x or 35.x address is not automatically a Google Cloud address.

65 Google Cloud Sources Across 23 Regions

The 65 matching sources were distributed across 23 Google Cloud regions.

The most frequently observed regions were europe-west1 (9), us-central1 (8), us-east4 (6) and us-east1 (6). Geography, however, was not the most significant finding: the sources did not all exhibit the same behavior.

Cluster 1 — Crusader Worker

The easiest cluster to identify consisted of clients explicitly presenting User-Agent: crusader-worker/1.0.

Observed targets included environment files, WordPress configuration remnants, Laravel logs and Ignition endpoints, Spring Boot Actuator endpoints and the distinctive /crusader-404-probe.

Within this dataset, 20 Crusader sources were distributed across 12 Google Cloud regions, consistent with the distributed behavior documented in our earlier 91-IP Crusader Worker investigation.

Read our original Crusader Worker 1.0 investigation →

Cluster 2 — AI/MCP Exposure Scanner

A second fingerprint targeted configuration and credential filenames associated with modern AI development environments.

Two sources stood out: 35.221.208.125 and 35.244.51.88. Each generated 24 HTTP requests, used the same Linux/Chrome 124 User-Agent and executed nearly identical probe vocabularies.

/.mcp.json
/mcp.json
/.claude.json
/.claude/mcp.json
/llm.json
/anthropic.json
/openai.json
/.openai
/ai.json
/api_keys.json
/service_account.json
/google.json

The activity extended beyond AI configuration files into shell and database history targets including .zsh_history, .mysql_history, .psql_history and .python_history.

A more accurate behavioral description is therefore an AI/MCP configuration + credential/history exposure scanner.

• 35.221.208.125 → asia-east1
• 35.244.51.88 → asia-south1

A nearly identical fingerprint was therefore observed from two separate Asian Google Cloud regions on the same day. This strongly supports a common scanner or toolchain, but does not establish a common operator.

Cluster 3 — PHP / Environment / GCP Credential Scanner

A third cluster displayed a structured sequence progressing from PHP and environment exposure discovery into service-account and cloud credential filenames.

/info.php
/php.php
/i.php
/pi.php
/pinfo.php
/test.php
/phpinfo
/debug.php
/php-info.php
/phpversion.php
/server-info.php
/_profiler/phpinfo
/_environment
/webroot/index.php/_environment
/info.php.bak
/sa.json
/gcp-key.json
/gcp-sa.json
/google-key.json
/key.json
/firebase-key.json

Four sources executed an identical or behaviorally equivalent 26-step sequence, while two additional sources showed a closely related 23-step variant. We therefore separate six high-confidence fingerprint matches.

Remarkably, those six high-confidence sources were distributed across six different Google Cloud regions spanning five continents.

• 34.174.153.31 → us-south1
• 34.35.75.239 → africa-south1
• 34.47.223.25 → asia-south1
• 35.199.98.118 → southamerica-east1

Repetition of an identical or near-identical endpoint sequence from cloud resources on different continents is strongly consistent with a shared scanner implementation or reusable scanning template. It does not establish common ownership or operation.

Cluster 4 — SSH and Private-Key Discovery

Other sources exhibited broader credential exposure discovery. For example, 35.237.192.115 directly requested SSH and private-key related paths:

/.ssh/known_hosts
/id_rsa
/id_dsa
/id_ed25519
/server.key
/key.pem
/id_ecdsa

This behavior is clearly distinct from ordinary content crawling and is consistent with automated discovery of accidentally exposed SSH keys, private keys and credential material.

Comparing the Three Main Scanner Clusters

There Is No Single “34/35 Botnet”

Sharing IP prefixes or a cloud provider does not establish common operation.

Our observations reveal at least three strongly distinguishable automation fingerprints: Crusader Worker; AI/MCP configuration and credential/history discovery; and PHP/environment/GCP credential discovery. Additional SSH/private-key exposure discovery activity was also observed.

Their regional distributions differ as well. Current evidence therefore fits multiple distributed scanning operations or toolchains using general-purpose cloud infrastructure substantially better than a single “34/35 scanner network” hypothesis.

Is Google Attacking These Servers?

No. Our evidence does not support that conclusion.

An address belonging to Google Cloud customer-resource prefixes does not mean Google operated the scanner. Cloud virtual machines and other resources can be operated by third-party customers.

The technically appropriate description is “scanning traffic observed from Google Cloud address space.” We do not attribute the activity to Google itself.

Evidence / Inference / Unknown

Conclusion

Of 80 unique 34.x/35.x sources observed between September 1 and September 6, 2026, 65 — 81.25% — matched Google Cloud customer-resource prefix data and were distributed across 23 regions.

But the traffic did not represent a single scanner. Distinct Crusader Worker, AI/MCP exposure, PHP/GCP credential and SSH/private-key discovery behaviors were observed.

The most notable finding is the repeated appearance of identical or near-identical scanner fingerprints from geographically separate Google Cloud regions. The evidence is consistent with a modern scanning ecosystem that can use distributed cloud workers and reusable scanning toolchains rather than single-host scanners.

Research note: Cloud IP addresses may be reassigned over time. IP count is not VM or operator count. Infrastructure provider and scanner operator are different facts. This research represents a 6 September 2026 snapshot.