# Filebeat Client talking to googleusercontent

**URL:** <https://discuss.elastic.co/t/filebeat-client-talking-to-googleusercontent/352951>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 9, 2024, 2:51pm UTC](https://discuss.elastic.co/t/filebeat-client-talking-to-googleusercontent/352951 "2024-02-09T14:51:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![drops](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@drops](https://discuss.elastic.co/u/drops)\
**Post date:** [February 9, 2024, 2:51pm UTC](https://discuss.elastic.co/t/filebeat-client-talking-to-googleusercontent/352951/1 "2024-02-09T14:51:48Z")

</div>

Hi there,

I just noticed that the filebeat agents installed on the clients are talking quite frequently to 34.111.17.235 ([235.17.111.34.bc.googleusercontent.com](http://235.17.111.34.bc.googleusercontent.com)). Is it possible to configure the agents not to do that without having to block the traffic?

Kind regards

Drops

 ![filebeat-googleusercontent](https://us1.discourse-cdn.com/elastic/original/3X/8/b/8ba98b5b9fb4314ddce6a2c6bb4a31d71f2c82aa.png)  
 ![filebeat-googleusercontent3](https://us1.discourse-cdn.com/elastic/original/3X/4/0/40339376a1e98d9705919b6437845fdd9a254dd4.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [February 9, 2024, 4:11pm UTC](https://discuss.elastic.co/t/filebeat-client-talking-to-googleusercontent/352951/2 "2024-02-09T16:11:58Z")

</div>

> [@drops](#):
>
> I just noticed that the filebeat agents installed on the clients are talking quite frequently to 34.111.17.235 ([235.17.111.34.bc.googleusercontent.com](http://235.17.111.34.bc.googleusercontent.com))

What do you have configured in your filebeat? Which modules did you enable?

Did you enable any [threat intel modules](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html#filebeat-module-threatintel), like the Abuse.ch module?

The IP address you shared is the endpoint for the Malwarebazer API of Abuse.ch, this is used by the threat intel module.

```auto
- module: threatintel
  malwarebazaar:
    enabled: true
    var.input: httpjson
    var.url: https://mb-api.abuse.ch/api/v1/
    var.interval: 10m

```

```auto
$ dig @8.8.8.8 mb-api.abuse.ch

; <<>> DiG 9.18.18-0ubuntu0.22.04.1-Ubuntu <<>> @8.8.8.8 mb-api.abuse.ch
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27000
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mb-api.abuse.ch. IN	A

;; ANSWER SECTION:
mb-api.abuse.ch.	181	IN	A	34.111.17.235

```

---

<div class="post-metadata">

**Author:** ![drops](https://avatars.discourse-cdn.com/v4/letter/d/f4b2a3/32.png) [@drops](https://discuss.elastic.co/u/drops)\
**Post date:** [February 9, 2024, 4:40pm UTC](https://discuss.elastic.co/t/filebeat-client-talking-to-googleusercontent/352951/3 "2024-02-09T16:40:29Z")

</div>

thnx a lot, didnt think of that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2024, 6:40pm UTC](https://discuss.elastic.co/t/filebeat-client-talking-to-googleusercontent/352951/4 "2024-03-08T18:40:34Z")

</div>

Closed on March 8, 2024, 6:40pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.