Hjdcti

I catch, save, and report all suspicious or malicious acts against my servers. Among the things I track are port scans on vulnerable ports (including the default ports for SSH, RDP, Plesk, and Webmin, none of which are in use on any of my servers), and actual failed login attempts to any protected service.

Alongside the usual suspects from present and formerly-communist states, I find a tremendous number of attempts by Google's bots not only to scan ports, but to actively attempt to log into password-protected services.

I understand that Google's spiders search the Interwebs for new and changed Web pages, which is why I whitelist their servers when I catch them hitting honeypots. But why the hell are they port scanning for service ports, and even worse, actively trying to log in to privileged services?

Check out these three links:

https://www.abuseipdb.com/check/130.211.246.128

https://www.abuseipdb.com/check/35.201.183.224

https://www.abuseipdb.com/check/35.204.251.155

Every AbuseIPDB user is free to word the attack reports however they like. Some, like me, give a generic description of the kind of attack to avoid revealing too much information. Others just post whatever their firewalls spit out.

Using whatever terminology, however, all of the pages contain multiple references to Google actively attempting to log in to services (they seem to have a special fondness for SSH and FTP), and failing due to authentication errors. Making actual login attempts goes way beyond Web crawling and, in my opinion, goes way over the line of acceptable behavior.

So what's this all about? Unauthorized penetration testing? That would be the most-defensible (and least-illegal) reason. So giving Google the benefit of the doubt and assuming that that's what they're doing, what's the proper response?

Other than when their bots hit HTTP honeypots, which could be dismissed as accidental, I block Google's IP's when they engage in what looks like mischief, just as I would block any other malicious IP. I didn't give them permission to do any of this; so as far as I'm concerned, they're no better than any other common hacker, cracker, or miscreant.

I think you’ll find that those are IP addresses for Google Cloud Platform, meaning that it’s not Google themselves but third parties running their own code on Google’s platform. So Google isn’t trying to hack you, it’s selling computing services to the public, some of whom are hackers.