DNS Question

Worker Joined: Sep 09, 2004 Posts: 106 Location: Canada

Hi, I'm wondering if it is possible to fake this crawl-66-249-65-233.googlebot.com for this IP 66.249.65.233. Meaning that the IP you will see is 66.249.65.233 but its faked through some proxi.

A lookup on the 66.249.65.233 took me to this Reverse DNS crawl-66-249-65-233.googlebot.com and continuing to investigate the DNS I ended at Google Inc.

Why, I'm asking, this IP is constantly posting junk on my FamilyTree site.

There was a weakness in the php script that I now block to avoid how the junk was being posted but I would really like to know if this is a genuing google bot.

Thanks

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

What kind of junk? Sex ads? Pharmacy crap?

Posted: Wed May 23, 2007 7:20 am

Hi Raven, Thanks. Here is a sample of one and one thing which is consistance is "viagra"

* href=\"http://www.isis.vanderbilt.edu/gmeforum/old/topic.asp?TOPIC_ID=172\">buy cialis</a> buy cialis * href=\"http://www.isis.vanderbilt.edu/gmeforum/old/topic.asp?TOPIC_ID=173\">buy levitra</a> buy levitra * href=\"http://www.isis.vanderbilt.edu/gmeforum/old/topic.asp?TOPIC_ID=174\">buy viagra</a> buy viagra * href=\"http://www.isis.vanderbilt.edu/gmeforum/old/topic.asp?TOPIC_ID=178\">kamagra</a> kamagra * href=\"http://www.isis.vanderbilt.edu/gmeforum/old/topic.asp?TOPIC_ID=175\">cheap cialis</a> cheap cialis 7cpo9b6gx81ii0l * href=\"http://www.isis.vanderbilt.edu/gmeforum/old/topic.asp?TOPIC_ID=177\">cheapest viagra</a> cheapest viagra * href=\"http://www.isis.vanderbilt.edu/gmeforum/old/topic.asp?TOPIC_ID=176\">cheap viagra</a> cheap viagra

Posted: Wed May 23, 2007 8:06 am

I would say it's forged.

Posted: Wed May 23, 2007 8:07 am

66.249.65.233 does seem to be owned by Google.

There are no simple ways to fake an IP. It is entirely possible, but it requires lower-level changes to the IP packets that most spamming software does not do. I have seen no indication that IP tricks are being used, that would probably kill the internet in its current form.

There have been reported on ways to make Google's bot initiate an attack, esp with simple SQL injections in the URL. But I've not seen Googlebot used to POST data submissions.

I get tons of these spammers hitting my submissions every day. I have not seen one coming from Google. Do you have the full logs of this spam?