While analysing a DDoS attack on my site using CloudFlare console, I've noticed that many attack requests come from AS139190 GOOGLE-AS-AP Google Asia Pacific Pte. Ltd. with Empty user agent.

I'm wondering how Google is exploited to attack my site?

2 Answers 2


Most likely someone using Google's Cloud Platform (GCP). They have a page here where you can report abuse on their platform.

  • Thanks for the tip. I've submitted a report. However I'm wondering do they actually investigate? And what Google does with attacking IPs?
    – blnks
    Oct 25, 2021 at 19:09
  • 15
    Yes, Google definitely investigates abuses cases, though I can't say how many of the reports turn into investigations. They will look into it and if they determine there was abuse, they will most likely terminate the account that spun up the infrastructure used. The IP itself belongs to a large pool that Google controls and will be given back out to another customer when and if the current user is terminated.
    – Dan
    Oct 25, 2021 at 19:15
  • 1
    @blnks: If you want to try and block the attack server side, you may find this information useful as well.
    – Kevin
    Oct 26, 2021 at 3:41
  • 7
    Google would most likely involve some level of machine learning to deal with abuse so your reports will actually make their automated system better, even if no investigation happens. One way or another it'll address the issue better than ignoring it.
    – Nelson
    Oct 26, 2021 at 3:51
  • 33
    @blnks People running DDoS attacks via cloud computing providers like GCP rarely intend to pay for those resources they use. Either because they hack into badly secured VMs of paying customers or because they pay using stolen credit card numbers. It's in Google's interest to stop these, because they result in disputed charges, which in turn either mean lost income or human hours being used to resolve those disputes.
    – Philipp
    Oct 26, 2021 at 12:43

If it really is a DDoS and not a malfunctioning script Google side, I can hazard a guess that it may come from Google cloud services provided to a client.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .