DDOS attack from google cloud ip range

[Roy Rutten]

Hi,

Yesterday and today we had a lot of traffic from the 35. and 34. range ip addresses on a few of our gce(different websites). In only one hour we got 1.7miljoen requests, sounds like a DDOS attack.

I want to be sure that this is not a googlebot or something. Is it possible to detect the user behind this range and let him stop doing this? Or is there is special google cloud support team that can check this for me?

A few of the most used ip addresses:

35.195.52.247

35.240.14.221

35.241.160.113

35.205.23.201

35.195.224.64

35.233.47.180

35.241.227.220

35.241.224.175

35.195.12.244

35.240.40.51

34.76.139.80

35.233.5.127

35.195.13.91

35.240.90.221

35.233.7.107

35.233.35.133

35.240.88.7

35.205.161.38

35.240.127.7

35.205.35.32

35.241.237.15

35.240.6.107

35.205.163.13

35.240.82.58

35.205.51.73

35.241.208.132

34.76.220.146

35.195.245.41

35.239.248.251

35.239.51.26

Any tips are welcome,

Thanks

Roy

[Shamma Nikhat (Cloud Platform Support)]

Hello Roy,

This issue need more investigation and also need project inspection. Group is not for troubleshooting issues , it is only for GCP discussions.

I would suggest you to create PIT [1]. But don't include any confidential information such as, project ID, before the PIT is made private.

[1] https://cloud.google.com/support/docs/issue-trackers