Noticing today that there is yet another strange visitor hitting our server/site from a Google IP. It came via a path to an old image that was never linked out to my knowledge. This disturbs me because it has a localhost referer with script strings dealing with "Fuzzing". (09/24/2015 11:07:38 AM) - Referrer pointing to their list of fuzz test cases running as a web service on the local machine:

Looking in Google reveals that handfuls of other sites have seen this referrer recently (even today) as well. The html file changes though, in those other examples it may be "fuzz-88", "fuzz-374", "fuzz-686", or even under random hash folders with new plugin such as "fuzz-extension-run-65".

EDIT: They are still hitting us with fuzzers every single day directed at or image folder(s). They all seem to come from Google cloud all now seem to be "attekett_dom_fuzzer" referrer:

Here is the list of 291 offending IP's fuzzing since March 2015. Any Googler have thoughts or insights on what this is?
  • It is a Google Cloud IP address and not the search engine. I see some chatter in this regard. You may want to consider blocking if it is too much of a PIA. You can avoid some of this regardless of source IP by blocking referrers that are localhost or or anything within a private range. This is likely a bad user. Cheers!!
    – closetnoc
    Commented Sep 24, 2015 at 20:33
  • 1
    @closetnoc Ah good call brother, it may indeed be malicious...i somehow forgot that they owned a giant public datacenter that anyone with $ can use haha. I should prob edit the Q
    – dhaupin
    Commented Sep 24, 2015 at 20:35
  • I got a bunch of hits from whatever IP range as their Google Apps thingy a while ago (maybe a year?). There is a SEO website built entirely on this. They get treated like users and get cut-off quickly for messing around. G really got themselves in a mess walking both sides of the fence in my book. They do web hosting and domain names too. At one point, all G IP addresses were in the same pool making the SE IPs bad guys too. But they fixed that kinda quickly. Whew!
    – closetnoc
    Commented Sep 24, 2015 at 20:42
  • What user-agent is it reporting? You say what the referrer is, but not the user agent. Commented Sep 25, 2015 at 10:28
  • When you say that the image was "never linked out", what does that mean? Does that mean that you never included it in any page or that it has never had external links? Commented Sep 25, 2015 at 10:29

1 Answer 1


The IP's in question track to Google Cloud and not the Google crawlers specifically. What this indicates is that someone has subscribed to one or more virtual servers on Google Cloud to run their code (more common now) and this could indeed be malicious. A good practice is to block localhost referrers as a matter of course as these should generally not be targeting your site, however that won't fully prevent this from happening. A good thing to do at this point if you have the time and energy is to block the offending IP's by your firewall rules, and to record the offending IP's and send them to the Google Cloud abuse team using the form located at https://support.google.com/code/contact/cloud_platform_report?hl=en which will then let Google investigate the offence. If this is happening against you there is a good chance it is happening to others as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.