Attack by google.?

[Mercury Forever]

Last week began the week with a problem of slowness evident in the Web platform, the strange thing of all this is that only the loading of the pages (the whole site) was very slow, the database with arta load of memory use .

As a side effect, the automatic tasks started to fail, they did not run and it had a huge list of outstanding background processes.

The identification of the problem led me to query the table ibf_core_search_index, but very often. the amount of online user was in normal parameters.

| 44464 | xxxxx | localhost | xxxxx | Prepare | 511 | Waiting for table metadata lock | / * IPS \ Content \ Search \ Mysql \ _Query :: filterForProfile: 240 * / SELECT COUNT (*) FROM ibf_core_search_index |

After three days of research, I detected 4 GOOGLE IP addresses that were generating more than 300 requests per second on the web, clearly affecting the performance.

Action: block the addresses in the firewall and report to google for your internal investigation.

35.225.10.246 # google, generates many comexiones - Fri Apr 26 02:43:16 2019
104,155,191,148 # goo - Fri Apr 26 02:49:30 2019
146.148.81.115 # google, generates many comexions - Fri Apr 26 02:50:27 2019
34.66.99.251 # google, generates many comexions - Fri Apr 26 02:52:07 2019

I share my experience for the community.

Regards,

[Makoto]

What you are seeing is abuse from Google Cloud customers, not Google themselves.

You can safely block these IP addresses (preferably at the server level if you can), otherwise using .htaccess rules if you're on a shared host.

[Mercury Forever]

It was reported, but I can not block all the google IPs ... they must be eternal! :)

https://support.google.com/code/contact/cloud_platform_report?hl=en

[tonyv]

On 4/27/2019 at 1:11 PM, Makoto said:

What you are seeing is abuse from Google Cloud customers

What is the point/goal of the abuse? What are they trying to do? Just trying to understand ...

[Makoto]

13 hours ago, tonyv said:

What is the point/goal of the abuse? What are they trying to do? Just trying to understand ...

Generally they are malicious scrapers or the likes. Bots that try and clone content from websites on other random domains for ad revenue and things like that.

That or some lower scale DDoS attacks can originate from cloud services like this sometimes.