0

I was alerted by my Plesk server that an IP Address had been banned. Normally I don't check banned IPs, but this one happened to coincide with our site going down for 1 minute at the same time.

Banned the following ip addresses on Mon Jul 27 21:05:01 AEST 2020
216.239.38.21 with 154 connections

I use the Web Application Firewall (ModSecurity) that plesk provides

A quick check tells me it is a Google IP: https://whatismyipaddress.com/ip/216.239.38.21

Hostname:   any-in-2615.1e100.net
ASN:    15169
ISP:    Google
Organization:   Google

However, Google have instructions on how Verifying Googlebot

Example 1:

> host 66.249.66.1
1.66.249.66.in-addr.arpa domain name pointer crawl-66-249-66-1.googlebot.com.

> host crawl-66-249-66-1.googlebot.com
crawl-66-249-66-1.googlebot.com has address 66.249.66.1

I also thought "154 connections sounds malicious", but according to Google's own Change Googlebot crawl rate, it shows an example of 5 per second, which would be 300 a minute

The term crawl rate means how many requests per second Googlebot makes 
to your site when it is crawling it: for example, 5 requests per second.
    
You cannot change how often Google crawls your site, but if you want
Google to crawl new or updated content on your site, you can request a recrawl.

After running nslookup -type=ptr 216.239.38.21 I get the same hostname as above, which resolves to a spammy Google Blogger looking website.

So, the IP address is Googles, but it's a spammy looking Blogger.com website, so does that mean it was malicious or a false positive?

The fact that the hostname is any-in-2615.1e100.net leads me to beleive it's a fairly sophisticated spoofed IP address, seems bizarre. I was hoping someone with more technical experince might have futher insights.

Maurice
  • 141
  • 1
  • 4
  • 1
    It's not necessarily Googlebot, but any Google service including Blogger: [What is 1e100.net?](https://support.google.com/faqs/answer/174717?hl=en) The error.log should have the WAF rule id that was fired, including other relevant details like the exact path, regexp etc. That's necessary to rule out false positives. – Esa Jokinen Jul 28 '20 at 00:36
  • Thanks, I'd hazard a guess this is a false positive since that's likely a Google domain. Sadly it doesn't show up in my logs so I've had to contact my provider to see what is going on. Maybe there is more to the story. – Maurice Jul 28 '20 at 06:39
  • In the cloud era it has become harder to distinguish solely based on the IP address whether it's coming from a service provided or from one of its customers. E.g. Microsoft Azure, Google GCP and Amazon AWS may seem like sources of legitimate traffic based on their reputation, but their customers could host anything there and, furthermore, those services do have vulnerabilities some malicious 3rd parties could abuse. – Esa Jokinen Jul 28 '20 at 07:00

0 Answers0