AIRLOCKPlay Gate

AS15169 · Catalog 2026.09.11

Official Play is not an IOC.

Google Play IPs rotate on anycast. Allow by domain. Block malware by hash and C2 — never by play.google.com.

Standing order

  1. 1. Firewall allow: official Play domains + AS15169 egress.
  2. 2. Hunt hashes, package names, and non-Google C2 IPs.
  3. 3. Never block play.google.com, play.googleapis.com, android.clients.google.com.

31

Allow domains

3

Malware families

4

Installer hashes

10

C2 / lure hosts