Google Cloud IP Ranges

Known IP ranges

The blocks below are the major address allocations associated with Google Cloud. A network of this size deaggregates heavily, so an individual route in the global routing table is usually more specific than the block shown. Prefix sets change over time — use WHOIS Lookup for the authoritative current record for any specific IP.

34.0.0.0/8 (partial)
35.0.0.0/8 (partial)
130.211.0.0/22
142.250.0.0/15
8.8.4.0/24
8.8.8.0/24

What does a Google Cloud IP mean in a privacy test?

A Google IP in a DNS test usually means your resolver is 8.8.8.8 or 8.8.4.4. A Google IP as your exit indicates traffic routes through Google Cloud or your VPN hosts servers on GCP.

Where Google publishes its IP list

Google publishes two JSON files side by side. https://www.gstatic.com/ipranges/goog.json is the list of Google-owned IP addresses. https://www.gstatic.com/ipranges/cloud.json is the global and regional external ranges available to customers' Google Cloud resources. Google's own documentation states the arithmetic to apply: take the ranges in cloud.json away from those in goog.json, and what remains is the space used by global Google APIs and Google's other customer-facing products.

Each file carries a syncToken and a creationTime, and each entry is an ipv4Prefix or ipv6Prefix with a service and a scope — the scope being a region such as africa-south1, or global. Google describes the lists as updated frequently rather than on a published schedule, which makes the creationTime in the copy you hold the only trustworthy statement about its age.

Google's own traffic versus a customer's virtual machine

Google separates the two along different autonomous systems, which makes this easier to answer here than on most clouds. Google's own services — Search, the crawler, Gmail, YouTube, and the 8.8.8.8 and 8.8.4.4 public resolvers — look up as AS15169, registered as GOOGLE. Google Cloud customer workloads look up as AS396982, registered as GOOGLE-CLOUD-PLATFORM. An external address on a Compute Engine instance normally falls inside cloud.json and returns the second of those, so the file and the ASN can be checked against each other.

That makes the two common cases separable. A Google address fetching pages from your site and looking up as AS15169 is Google's own infrastructure. An address on AS396982, or one that appears in cloud.json, is a rented machine — the tenant is named in neither file, and WHOIS returns Google for all of them. In a DNS test, a Google result is the resolver that answered your queries rather than the address a website sees you from; those are two different measurements and they can legitimately name two different networks.

Related tools

Frequently asked questions