Overview
Google’s primary ASN, AS15169, announces tens of thousands of IPv4 and IPv6 prefixes spanning consumer products (Search, YouTube, Gmail), enterprise services (Workspace, Cloud), and infrastructure (Public DNS, Anycast edge). Google publishes its full IP range list as JSON files that update regularly — goog.json for all Google-owned ranges, cloud.json for Google Cloud specifically.
Services on these IPs
IPs from AS15169 may be: Google Search crawlers (googlebot), YouTube CDN, Gmail SMTP servers, Google Cloud VMs (Compute Engine), Cloud DNS resolvers, AdSense ad servers, or Google Workspace API endpoints. The cloud.json subset is what cloud customers can use to allowlist GCP services in firewalls.
How to detect Google IPs
To verify if an IP is Googlebot specifically, reverse-DNS lookup should return crawl-*.googlebot.com or crawl-*.google.com, and forward-DNS of that hostname should resolve back to the same IP. For general Google ownership, check the IP’s ASN — AS15169 is definitive.
When this matters
SEO admins allowlist Google ranges to avoid accidentally blocking Googlebot. Network admins identify legitimate Google traffic vs. spoofed connections. Security analysts trace suspicious activity that appears to come from Google Cloud (often abused for command-and-control).
Caveats
Google Cloud customers run untrusted workloads on Google IPs. A connection from a Google IP is not inherently legitimate — it could be a GCP VM rented by an attacker. Always combine ASN check with reverse-DNS and behavioral analysis.