Hits from 104.132.0.0/16 (Google) - human or bot?

[SumGuy]

I got a hit this morning (4 am eastern time) from 104.132.61.X (corpnat-104-132-61-X.corp.google.com). Some of the IP's in that /24 resolve to guestnat-whatever.corp.google.com. It looks like a legit human hit, all the right files were requested. Just hit our main page, went no further into the site. No referrer. User Agent was:

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3669.0 Safari/537.36

Some Geo-IP says Munich Germany (?), some say Kitchener (Ontario). Asname GOOGLE-IT-RO-ISP.

Corpnat? Does google provide corp/business ISP service in Germany (or Ontario)? Still, a human hit from a corp in Germany first thing sunday morning? Let alone at 4 am from Kitchener.

Or is this like the hits you'd see from google-user-content IP's (ie rented servers)?

My history of hits from 104.132.0.0/16 is sparse. One hit in Oct 2016 (only to favicon.ico ?), hits to a few pages in Jan and June 2018 (looks human - Chrome on Mac OSX), and then this hit today.

[lucy24]

User Agent was:

Hm, now that's interesting. I didn't recognize the IP either so I looked it up and found, what do you know, (Pacific time, making it 11pm Eastern)

104.132.61.abc - - [09/Feb/2019:20:34:30 -0800] "GET / HTTP/1.1" 200 3065 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3669.0 Safari/537.36"

et cetera, fully human including piwik script. I initially thought they didn't act on it, but turns out they changed to their IPv6 address 2a00:79e0:etcetera which resolves to Google in Switzerland. (I only found out because I cross-checked the user-agent, and this was the sole hit. Is Chrome 73 for Linux the latest release? I don't see it at all, in any variant, before mid-December.)

I too find the whole /14 ascribed to Google in Munich, which I guess explains the ARIN IP. Like you, I only find one other recent human visit, even when casting the net a little more widely to cover all of 132-135:

104.132.1.abc - - [25/May/2018:18:42:10 -0700] "GET / HTTP/1.1" 200 3015 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5 Build/MOB31V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3441.0 Mobile Safari/537.36"

Dunno about your site, but on mine, “cold” human requests for the front page are exceedingly rare, because it’s just not that kind of site.

Hmmm.

[TorontoBoy]

Is Chrome 73 for Linux the latest release? I don't see it at all, in any variant, before mid-December.)

My current Chrome on Ubuntu is Version 72.0.3626.81 (Official Build) (64-bit)

104.132.0.0 - 104.135.255.255
CIDR: 104.132.0.0/14
NetName: GOOGLE-CORP

~$ host 104.132.61.1
Host 1.61.132.104.in-addr.arpa. not found: 3(NXDOMAIN)
~$ host 104.132.61.100
100.61.132.104.in-addr.arpa domain name pointer guestnat-104-132-61-100.corp.google.com.

[aristotle]

I see a lot of visits from corporations and government agencies. Some people do personal browsing on company computers and company time.

Occasionally I see a human visit from a google IP (but usually Mountain View), either exploring several pages or just one page. I think it's usually personal browsing, but can't rule out the possibility of someone doing a manual review.

[ClosedForLunch]

Occasionally I see a human visit from a google IP (but usually Mountain View), either exploring several pages or just one page. I think it's usually personal browsing, but can't rule out the possibility of someone doing a manual review.

One of my websites recently got a visit from a human via corp.google.com (using Chrome 71 on Windows 10). The site was under review for Adsense approval. The human looked at a few pages - 15 minutes later I got an email from Google approving the site.

@SumGuy Maybe your site is getting a manual review for some reason. Hopefully a good reason.

[SumGuy]

> Maybe your site is getting a manual review for some reason

It was just a hit to our main page - nothing more than a "spash" screen showing our logo on a nice background, with links to various internal parts. No real content on the page. It takes 32 file-requests to paint the page (1 html, 1 favicon.ico, and 30 gifs). I use that as my first clue that a human behind a browser was responsible for the hit. The web-code on the site is circa 2000. No links to google-anything, no links to trackers, ad networks, no links offsite period. No further visits since my original post. I think it was a robtex lookup that said the IP was in Kitchener. Either way, a hit from a "corp" in Germany at 10 am on a Sunday, well I guess anything is possible. Again I ask, does google provide ISP service in Germany?

One more tid-bit: An IP that is very close to the hit mentioned in the first post made this edit to the wikipedia entry on "Front and back ends" almost exactly 1 year ago:

[en.wikipedia.org...]

This apparently pertains to software "front and back ends". When I'm sufficiently interested in a given IP or subnet, I'll check and see if wikipedia has seen any article-editing activity from it. If it has, sometimes the topic or the nature of the edit can tell me something about who's on the other end of the IP.

[lucy24]

does google provide ISP service in Germany?

News to me, if so. And in some ways it doesn't feel like an ordinary human. I said above that I’m not a front-driven site, so requests for the front page are rare. When a human does visit, it’s typically someone who entered on an interior page and is now poking around to see what the rest of the site is all about.

Since there are national googles practically everywhere on the planet, it isn't surprising to find IP blocks allocated that way, with associated humans. They can't run everything out of Mountain View. I'm not very good at finding things on wikipedia, but I'll bet somewhere there is a list of all known google IP ranges. And then we can start investigating visits from Google offices in Bangalore or Osaka.

:: detour to raw logs ::

Yeah, that's what I thought. People are at least 20 times as likely to enter on an interior page as on the front page. (This won't work on all sites, but I tested by searching for requests for /sharedstyles.css giving the front page as referer. If they've already seen some other page, a normal human browser won't request the same stylesheet again just a few minutes later.)

An IP that is very close to the hit mentioned in the first post

Yeah. Without getting any more specific than we're allowed to get, the cited IP there is within /28 of the one I found in logs too.

[kobi]

Found this site when googling a google IP address that in my case the entity submitted a loan application form, but with fake data.

Upon further research...

[abuseipdb.com...]