2009-08-22

Why Is Google Port Scanning Me?

I’m used to the normal ‘Internet background radiation’ of hackers/bots scanning the common ports on my router (SSH, VNC, etc.) but recently I’ve noticed scans of multiple ports from IPs registered to Google.

e.g., I'm getting a few thousand a day of these:
[INFO] Sat Aug 22 11:43:44 2009 Blocked incoming TCP packet from 66.102.7.191:80 to xxx:47414 as ACK received but there is no active connection
[INFO] Sat Aug 22 11:43:44 2009 Blocked incoming TCP packet from 66.102.7.191:80 to xxx:15370 as ACK received but there is no active connection
[INFO] Sat Aug 22 11:43:44 2009 Blocked incoming TCP packet from 66.102.7.191:80 to xxx:63879 as ACK received but there is no active connection
[INFO] Sat Aug 22 11:43:44 2009 Blocked incoming TCP packet from 66.102.7.191:80 to xxx:7748 as ACK received but there is no active connection
Looking back I see these requests have been coming for months but have increased in frequency recently.

They come from a range of IPs which whois reports are assigned to Google:
66.102.7.101
66.102.7.191
74.125.15.22
74.125.15.93
74.125.15.100
74.125.15.157
74.125.19.118
74.125.103.33
74.125.103.96
74.125.103.97
etc.
So for what purpose is Google port scanning me?

UPDATE:
These are likely just delayed responses to a web page request made by your browser just before you quit your web browser.

3 comments:

Anonymous said...

I don't think these are delayed anything. There is something going on. This has been happening to our ISA sever for the last few days. I have just received about 40 of these notificaions:

"ISA Server detected an all port scan attack from Internet Protocol (IP) address 66.249.89.100."

That IP address is coming back as Google. What is going on!

taiqi said...

I receive an alert from my virus protection (VirusBarrier X6) that a port scan was attempted. VirusBarrier X6 asked me if I want to block it. I did. The "perp" came from 74.125.53.132. I talked to my ISP and they weren't concerned, saying that it was just Google wanting to update something so they could gather consumer information. On further questioning they could not guarantee that it wasn't some hacker trying to access my computer.
Even if it was legitimate, I am pissed that some corporation has the right to access information off of my personal computer.

Anonymous said...

I too can confirm some serious scanning going on from google. I see almost a constant scan on my firewall from google ip addresses.