Hacker News Reader

A whois on the 35.241.245.36 returns a ownership by Google with the following comment:

Comment: * The IP addresses under this Org-ID are in use by Google Cloud customers *

He then uses the SSRF to issue a request to his own server after which he likely realizes that the IP address belonging to the backend service also runs on GCP.

After working with AWS a ton, I commonly spot their IP addresses while reviewing random data sets. 50., 52., etc... This person has probably just worked with GCE a bit.

I think both make me think this is a GCP machine. like if you see a A record point to 104.xx.xx.xx, then you might think this is a Cloudflare protected record.