Skip to content

Instantly share code, notes, and snippets.

@abliss
Created July 22, 2015 17:50
Show Gist options
  • Save abliss/eb85e6a75008a76f11b7 to your computer and use it in GitHub Desktop.
Save abliss/eb85e6a75008a76f11b7 to your computer and use it in GitHub Desktop.
** WORKS:
*** https://www.google.com/webmasters/tools/mobile-friendly/?url=https%3A%2F%2Fdprtube.com
routed to 162.210.249.2
*** https://www.google.com/webmasters/tools/mobile-friendly/?url=https%3A%2F%2Fyourinboxadz.com
routed to 162.210.249.5
*** https://www.google.com/webmasters/tools/mobile-friendly/?url=https%3A%2F%2Fyourdoorway2success.com
routed to 162.210.249.5
** FAILS:
*** https://www.google.com/webmasters/tools/mobile-friendly/?url=https%3A%2F%2Fjuicepressousa.com
routed to 162.210.249.3
*** https://www.google.com/webmasters/tools/mobile-friendly/?url=https%3A%2F%2Fclients.myworkshosting.com
routed to 162.210.249.3
** https://www.google.com/webmasters/tools/mobile-friendly/?url=https%3A%2F%2Fcoffeespecialteas.com
routed to 162.210.249.3
** https://www.google.com/webmasters/tools/mobile-friendly/?url=https%3A%2F%2Fkb.mautobu.com
routed to 162.210.249.3
** https://www.google.com/webmasters/tools/mobile-friendly/?url=https%3A%2F%2Fserps.com
routed to 162.210.249.3
@abliss
Copy link
Author

abliss commented Jul 22, 2015

Note: I am running this command

tcpdump dst host 162.210.249.229 and dst port 443 and tcp[tcpflags] & (tcp-syn) != 0

to capture all incoming TCP connections on port 443. I occasionally see googlebots coming in for GoogleImageProxy, Google favicon, Feedfetcher-Google, and even one Google Webmaster Tools. But when running this test (or the Fetch As Google tool), I see no traffic coming in from google.

This would suggest that somehow, packets for port 443 from some subset of google's proxies are being dropped at 162.210.249.3.

@abliss
Copy link
Author

abliss commented Jul 22, 2015

To get a sense of the IPs, I ran this a few times:
https://www.google.com/webmasters/tools/mobile-friendly/?url=https%3A%2F%2Frequestbin.herokuapp.com%2F19qssuj1

Then I checked the bin. It shows hits from these ips:

  • 66.249.64.206
  • 66.249.64.117
  • 66.249.64.140

Note that these all resolve from crawl-X-Y-Z-W.googlebot.com .

Meanwhile, my tcpdump has captured successful HTTPS connections (verified in apache logs) from these IPs this morning:

  • google-proxy-66-102-6-203.google.com
  • google-proxy-66-102-7-250.google.com
  • google-proxy-66-249-83-182.google.com
  • google-proxy-66-249-83-182.google.com
  • google-proxy-66-249-93-192.google.com

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment