homepage Welcome to WebmasterWorld Guest from 184.72.82.126
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member

Visit PubCon.com
Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL

Search Engine Spider and User Agent Identification Forum

    
Googlebot trying port 21
Peter




msg:4386549
 9:25 pm on Nov 13, 2011 (gmt 0)

Something rather strange in the firewall logs: Googlebot (from 66.249.71.97) seems to be trying to access port 21 on my server.

Four attempts today, at 15.21 and 15.23, then at 21.34 and 21.35. There is no FTP on this server, and there never has been.

Has anyone else seen this?

Peter.

 

dstiles




msg:4386901
 10:06 pm on Nov 14, 2011 (gmt 0)

It certainly claims to be googlebot in DNS. Hasn't hit my (SSL) FTP servers but we know google is evil... :(

SteveWh




msg:4387868
 12:25 am on Nov 17, 2011 (gmt 0)

Just a few ideas, not sure how valid they are:

Maybe Googlebot encountered a bogus ftp:// link to your site somewhere on the web, and is checking it out.

Maybe Google is doing some sort of survey about the features or security of sites on the web, including such things as availability of anonymous FTP, or something like that.

I don't know if Google employees can use the crawler server IPs to do manual web fetches, but it seems like they might have that ability. Not clear what the point of it would be in this case, though.

Elysia




msg:4426531
 3:16 pm on Mar 8, 2012 (gmt 0)

Hi all, new to the forum but was searching to find why this might be happening, and saw your topic here. I've had exactly the same issue yesterday on a VPS, where the secure log is showing 2 sets of three login anonymous FTP attempts from what appears to be googlebot, as follows: (server details anonymised for security)

Line 164878: Mar 7 10:05:42 server proftpd[3795]: server.example.com (66.249.71.116[66.249.71.116]) - USER anonymous: no such user found from 66.249.71.116 [66.249.71.116] to (IP address removed):21

Line 164879: Mar 7 10:05:42 server proftpd[3795]: server.example.com (66.249.71.116[66.249.71.116]) - mod_delay/0.5: delaying for 121 usecs

Line 164880: Mar 7 10:05:42 server proftpd[3795]: server.example.com (66.249.71.116[66.249.71.116]) - FTP session closed.

Line 164882: Mar 7 10:05:42 server proftpd[3796]: server.example.com (66.249.71.116[66.249.71.116]) - USER anonymous: no such user found from 66.249.71.116 [66.249.71.116] to (IP address removed):21

Line 164883: Mar 7 10:05:42 server proftpd[3796]: server.example.com (66.249.71.116[66.249.71.116]) - mod_delay/0.5: delaying for 74 usecs

Line 164884: Mar 7 10:05:42 server proftpd[3796]: server.example.com (66.249.71.116[66.249.71.116]) - FTP session closed.

66.249.71.116 appears to be crawl-66-249-71-116.googlebot.com but I'm puzzled why a search bot should be attempting an FTP login on a VPS. Is googlebot's IP address being spoofed?

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved