104.199.128.134

[andrew_thom]

Hello
This ip seems to belong to Google. But it searches wordpress plugins like a malicious way.
I am not sure to block this ip or not.
Is there any Google security crawler that search the site?
Cheers

[tangor]

When in doubt, block it out.

Others will day do research first, then block it.

Other others will say do nothing.

On the other hand, it is your site. You are allowed to vet the behavior of visitors, bots or not, and decide who comes in, or who is locked out.

Note: blocking now is not a terrible thing. You can always reverse it at a later time.

[tangor]

Secondary thought: Something searching for WP plugins instead of content would be on my hit list of unwanted. YMMV.

[lucy24]

Cripes, there's two of them:
[webmasterworld.com...]

Lots of things belong to Google. But if it isn't a recognized crawl range, and the user-agent isn't Googlebot or some other known* G### entity, you don't risk much by blocking 'em. And I can't think of any reason, at all, whatsoever, under any circumstances, where a legitimate law-abiding agent would be searching for WP files. Even WP itself doesn't run security checks unasked, does it?


* For present purposes, “AppEngine-Google” does not count as a known Google entity. Some people will count it as a “shoot to kill” or “block on sight”; ymmv.

[TorontoBoy]

104.199.128.134 is a google cloud IP, for Google paying customers, so not Google Inc. Block it.

NetRange: 104.196.0.0 - 104.199.255.255
CIDR: 104.196.0.0/14
NetName: GOOGLE-CLOUD
NetHandle: NET-104-196-0-0-1
Parent: NET104 (NET-104-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS15169
Organization: Google LLC (GOOGL-2)
RegDate: 2014-08-27
Updated: 2015-09-21
Comment: ** The IP addresses under this netblock are in use by Google Cloud customers **

$ host 104.199.128.134
134.128.199.104.in-addr.arpa domain name pointer 134.128.199.104.bc.googleusercontent.com.

[not2easy]

UAs with AppEngine are blocked on my sites. Never seen one visiting as a human and unwanted in my view. View your access logs before just blocking anything, but unless it is part of a service you agreed to, it is unlikely to be beneficial.

Since you mention it is requesting plugins, check access logs (or headers) to see whether it is part of some plugin you use. Then be sure you need that plugin and nothing else will do.

[blend27]

.. in use by Google Cloud customers ..

oops, dropped on my sites for a while now!