Google Bot operating from 192.178.6.0/24

Something new?

[SumGuy]

I noticed recently some hits from 192.178.6.x where x is typically 35,36,37. These are google IP's (AS15169). Host names are crawl-192-178-6-37.googlebot.com.

I scanned my logs and note these hits happened for a few days last year (July 4 - July 11) and then nothing until a few days ago (Jan 17). The hits from July came from 192.178.6.X where X = 1 to 10.

User Agents have been these:

Googlebot/2.1 (+ht tp:// www . google . com/bot.html)

Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML ike Gecko) Chrome/125.0.6422.175 Mobile Safari/537.36 (compatible; Googlebot/2.1; +ht tp:// www . google . com/bot.html)

Mozilla/5.0 (compatible; Googlebot/2.1; +ht tp:// www . google . com/bot.html)

The strange thing about these hits - last year (the July hits) they hit me first on port 80 (HTTP) and get 301 re-direction to port 443 (HTTPS) which they follow. But these recent hits from a few days ago, they again hit me on port 80, they get 301 re-direction codes but they're not following them - they just go away. So they don't show up in my HTTPS logs.

I'm still getting all the regular hits (both http and https) from 66.249.66.what-ever.

[lucy24]

they again hit me on port 80, they get 301 re-direction codes but they're not following them

Were they requesting files they had previously got at https, or new material they’d never seen before?

:: side trip to raw logs ::

Oh, looka that. Only on my personal site, not the main site. http:

192.178.6.abc - - [16/Jan/2025:18:39:24 -0800] "GET /robots.txt HTTP/1.1" 200 4136 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 
192.178.6.abc - - [16/Jan/2025:18:39:24 -0800] "GET / HTTP/1.1" 403 3009 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 

(The 403 is because I block anything claiming to be googlebot that isn't from 66.249.etcetera.) But mark the sequel:

34.116.39.abc - - [17/Jan/2025:02:10:47 -0800] "HEAD / HTTP/1.1" 403 282 "http://example.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 AppEngine-Google; (+http://code.google.com/appengine; appid: s~virustotalcloud)" 
3.131.151.abc - - [17/Jan/2025:02:10:47 -0800] "GET / HTTP/1.1" 403 2965 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.51" 
3.145.101.abc - - [17/Jan/2025:02:10:47 -0800] "GET / HTTP/1.1" 403 2965 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.51" 
192.178.6.abc - - [17/Jan/2025:02:10:47 -0800] "GET / HTTP/1.1" 403 3009 "-" "GoogleOther" 
34.116.39.abc - - [17/Jan/2025:02:10:48 -0800] "GET / HTTP/1.1" 403 3009 "http://example.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36 AppEngine-Google; (+http://code.google.com/appengine; appid: s~virustotalcloud)" 

GoogleOther? wtf? I include the surrounding lines because this is a low-traffic site, so it's very unlikely to see two wholly unrelated requests within the same second.

Cross-check for GoogleOther turns up a handful of “GoogleOther” and-that’s-all from Googlebot IPs at more than one site ... but also a couple of thousand

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GoogleOther) Chrome/122.0.6261.94 Safari/537.36

from assorted IPs in the 66.249.64-70 range. All blocked due to header deficits.

None of which answers your question, but does merit a The Plot Thickens.