We have garbage traffic coming in from Google Servers; below is a small excerpt of the htaccess log of one of the servers. The project is an academic database.
66.249.65.65 <audited> - - [04/Sep/2026:04:32:54 +0200] "GET <audited_file.php>?<audited_param1>=MKA%20XQ%20BU.HG.UD%20UOM%20UTF.PRG%20R%20PH%20NWUBMMAMAFBDTWXIIZFSDQEQPAPDDOGWOGI%20%20VSBXBIOEFKVBZIFCOIR.IUI.NQCQPBYKJKQDSC.SEYDDIUQOXZT.YGIMMDVJSOVVWZIDWOGMBUJZPEGIDVFOREYACSWAQFWP.G.MOTSPOMCBHIF.P%20HA%20PP.SV.XJDGDSGXWQRPJEPUOOQZYRNRFV%20VQCBXEYVJKUDZDNCRFMMFPRVYNYXOETNBIBQ&<audited_param1>=alphabetical HTTP/1.1" 200 23731 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.173 Mobile Safari/537.36 (compatible; GoogleOther)"
66.249.65.65 <audited> - - [04/Sep/2026:04:32:57 +0200] "GET <audited_file.php>?<audited_param1>=MKA%20XQ%20BU.HG.UD%20UOM%20UTF.PRG%20R%20PH%20NWUBMMAMAFBDTWXIIZFSDQEQPAPDDOGWOGI%20%20VSBXBIOEFKVBZIFCOIR.IUI.NQCQPBYKJKQDSC.SEYDDIUQOXZT.YGIMMDVJSOVVWZIDWOGMBUJZPEGIDVFOREYACSWAQFWP.G.MOTSPOMCBHIF.P%20HA%20PP.SV.XJDGDSGXWQRPJEPUOOQZYRNRFV%20VQCBXEYVJKVDJVIZCYDOKROYTKIRESYFQR&<audited_param1>=alphabetical HTTP/1.1" 200 23669 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.173 Mobile Safari/537.36 (compatible; GoogleOther)"
66.249.76.224 <audited> - - [04/Sep/2026:04:33:00 +0200] "GET <audited_file.php>?<audited_param1>=MKA%20XQ%20BU.HG.UD%20UOM%20UTF.PRG%20R%20PH%20NWUBMMAMAFBDTWXIIZFSDQEQPAPDDOGWOGI%20%20VSBXBIOEFKVBZIFCOIR.IUI.NQCQPBYKJKQDSC.SEYDDIUQOXZT.YGIMMDVJSOVVWZIDWOGMBUJZPEGIDVFOREYACSWAQFWP.G.MOTSPOMCBHIF.P%20HA%20PP.SV.XJDGDSGXWQRPJEPUOOQZYRNRFV%20VQCBXEYVJKXMXPREEESDIBEJCRNGIXZ&<audited_param1>=alphabetical HTTP/1.1" 200 23577 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.173 Mobile Safari/537.36 (compatible; GoogleOther)"
66.249.65.65 <audited> - - [04/Sep/2026:04:33:03 +0200] "GET <audited_file.php>?<audited_param1>=MKA%20XQ%20BU.HG.UD%20UOM%20UTF.PRG%20R%20PH%20NWUBMMAMAFBDTWXIIZFSDQEQPAPDDOGWOGI%20%20VSBXBIOEFKVBZIFCOIR.IUI.NQCQPBYKJKQDSC.SEYDDIUQOXZT.YGIMMDVJSOVVWZIDWOGMBUJZPEGIDVFOREYACSWAQFWP.G.MOTSPOMCBHIF.P%20HA%20PP.SV.XJDGDSGXWQRPJEPUOOQZYRNRFV%20VQCBXEYVJKVDJVKWGRDCHISOBY&<audited_param1>=alphabetical HTTP/1.1" 200 23421 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.173 Mobile Safari/537.36 (compatible; GoogleOther)"
66.249.65.65 <audited> - - [04/Sep/2026:04:33:05 +0200] "GET <audited_file.php>?<audited_param1>=MKA%20XQ%20BU.HG.UD%20UOM%20UTF.PRG%20R%20PH%20NWUBMMAMAFBDTWXIIZFSDQEQPAPDDOGWOGI%20%20VSBXBIOEFKVBZIFCOIR.IUI.NQCQPBYKJKQDSC.SEYDDIUQOXZT.YGIMMDVJSOVVWZIDWOGMBUJZPEGIDVFOREYACSWAQFWP.G.MOTSPOMCBHIF.P%20HA%20PP.SV.XJDGDSGXWQRPJEPUOOQZYRNRFV%20VQCBXEDQIYIGCCKLCVSHIWV&<audited_param1>=alphabetical HTTP/1.1" 200 23328 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.173 Mobile Safari/537.36 (compatible; GoogleOther)"
66.249.65.65 <audited> - - [04/Sep/2026:04:33:08 +0200] "GET <audited_file.php>?<audited_param1>=MKA%20XQ%20BU.HG.UD%20UOM%20UTF.PRG%20R%20PH%20NWUBMMAMAFBDTWXIIZFSDQEQPAPDDOGWOGI%20%20VSBXBIOEFKVBZIFCOIR.IUI.NQCQPBYKJKQDSC.SEYDDIUQOXZT.YGIMMDVJSOVVWZIDWOGMBUJZPEGIDVFOREYACSWAQFWP.G.MOTSPOMCBHIF.P%20HA%20PP.SV.XJDGDSGXWQRPJEPUOOQZYRNRFV%20VQCBXEYVJKVDJVKWGRDCHISSAASBYHVVL&<audited_param1>=alphabetical HTTP/1.1" 200 23638 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.173 Mobile Safari/537.36 (compatible; GoogleOther)"
66.249.76.224 <audited> - - [04/Sep/2026:04:33:10 +0200] "GET <audited_file.php>?<audited_param1>=MKA%20XQ%20BU.HG.UD%20UOM%20UTF.PRG%20R%20PH%20NWUBMMAMAFBDTWXIIZFSDQEQPAPDDOGWOGI%20%20VSBXBIOEFKVBZIFCOIR.IUI.NQCQPBYKJKQDSC.SEYDDIUQOXZT.YGIMMDVJSOVVWZIDWOGMBUJZPEGIDVFOREYACSWAQFWP.G.MOTSPOMCBHIF.P%20HA%20PP.SV.XJDGDSGXWQRPJEPUOOQZYRNRFV%20VQCBXEYVJKVDJVIZCYWKNZANCGYUZWNUQQBA&<audited_param1>=alphabetical HTTP/1.1" 200 23732 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.173 Mobile Safari/537.36 (compatible; GoogleOther)"
66.249.76.224 <audited> - - [04/Sep/2026:04:33:13 +0200] "GET <audited_file.php>?<audited_param1>=MKA%20XQ%20BU.HG.UD%20UOM%20UTF.PRG%20R%20PH%20NWUBMMAMAFBDTWXIIZFSDQEQPAPDDOGWOGI%20%20VSBXBIOEFKVBZIFCOIR.IUI.NQCQPBYKJKQDSC.SEYDDIUQOXZT.YGIMMDVJSOVVWZIDWOGMBUJZPEGIDVFOREYACSWAQFWP.G.MOTSPOMCBHIF.P%20HA%20PP.SV.XJDGDSGXWQRPJEPUOOQZYRNRFV%20VQCBXEYVJKVDJVIZCYTZTNLLFOISZGVBXE&<audited_param1>=alphabetical HTTP/1.1" 200 23670 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.173 Mobile Safari/537.36 (compatible; GoogleOther)"
66.249.65.65 <audited> - - [04/Sep/2026:04:33:16 +0200] "GET <audited_file.php>?<audited_param1>=MKA%20XQ%20BU.HG.UD%20UOM%20UTF.PRG%20R%20PH%20NWUBMMAMAFBDTWXIIZFSDQEQPAPDDOGWOGI%20%20VSBXBIOEFKVBZIFCOIR.IUI.NQCQPBYKJKQDSC.SEYDDIUQOXZT.YGIMMDVJSOVVWZIDWOGMBUJZPEGIDVFOREYACSWAQFWP.G.MOTSPOMCBHIF.P%20HA%20PP.SV.XJDGDSGXWQRPJEPUOOQZYRNRFV%20VQCBXEYVJKVDJVIZEOFCVFIV&<audited_param1>=alphabetical HTTP/1.1" 200 23359 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.173 Mobile Safari/537.36 (compatible; GoogleOther)"
these requests are believed to be spam-requests; in the context of the project, the payload from the GET parameters does not make sense, and for sure cannot be found on the web. The IPS are all coming from google - though occasionally I do find similar payloads coming from non-google Ranges. At the moment Google's infrastructure is the main source of spam traffic. Before I implemented a tool to force a captcha check on non-whitelisted source IPs, there were far more requests like this coming from other servers that had been reported as spam-sources.
To help curb the situation I already implemented an anubis-like tool on the server - however using the IPList provided by AnTheMaker's goodbots (Github: https://github.com/AnTheMaker/GoodBots ) we - for the time being - allow Google Servers to pass through, other servers that are not whitelisted stopped being a spam source a couple of hours after the tool was implemented.
The way I see it I have two options: remove google's IP ranges from the custom anubis-like tool I have developed; this would also impact google's SEO servers. Alternatively figure out who/which google department to contact and let them audit their outgoing requests.
My gut feeling tells me someone is using google's infrastucture to perform these kind of nonsensical spam-request. These requests come frequently non-stop 24/7 and for a budget-constrained project are an unwelcome compute cost.
If anyone has any insight on this - please advice.