[159682] in North American Network Operators' Group
=?utf-8?Q?Re=3A_Intermittent_incorrect_DNS_resolution=3F?=
daemon@ATHENA.MIT.EDU (Erik Levinson)
Thu Jan 17 20:43:11 2013
Date: Thu, 17 Jan 2013 20:42:58 -0500 (EST)
From: "Erik Levinson" <erik.levinson@uberflip.com>
To: "Damian Menscher" <damian@google.com>
In-Reply-To: <CABSP1Odp-qGWXjLibU7asU4Txys4NZ=KN3AWqrwtA3eEHBgGvA@mail.gmail.com>
Cc: NANOG mailing list <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Thanks Damian. I see four requests with Google UAs from actual Google IPs, =
66.249.73.45 and 66.249.73.17 (PTR and rwhois seem yours for both), in a pe=
riod of 30 minutes (compared to over 80 per minute on the new IPs). This is=
pretty low, so I'm not too worried. =0A=0ABaidu is the main culprit now; t=
here's little other traffic. In fact, we're getting no traffic from Baidu o=
n the new IPs, only to the old ones. I've already e-mailed their spider hel=
p e-mail, but it's fallen on deaf ears.=0A=0AErik=0A=0A-----Original Messag=
e-----=0AFrom: "Damian Menscher" <damian@google.com>=0ASent: Thursday, Janu=
ary 17, 2013 1:58pm=0ATo: "Erik Levinson" <erik.levinson@uberflip.com>=0ACc=
: "NANOG mailing list" <nanog@nanog.org>=0ASubject: Re: Intermittent incorr=
ect DNS resolution?=0A=0AOn Wed, Jan 16, 2013 at 8:09 PM, Erik Levinson=0A<=
erik.levinson@uberflip.com>wrote:=0A=0A> To give an idea of the scale of th=
e problem right now, I'm getting=0A> thousands of requests per minute to a =
new IP vs. about two requests per=0A> minute on the equivalent old IP, with=
over 60% of the latter being Baidu,=0A> but also a bit of Googlebot and ot=
her random bot and non-bot UAs.=0A>=0A=0AIt's common for malware to spoof t=
he Googlebot user-agent since they know=0Amost webmasters won't block it. =
You might want to check whether the IPs=0Ayou're seeing it from are really =
allocated to us -- if so, I'd be=0Ainterested in tracking down why we're cr=
awling your old IP.=0A=0ADamian=0A
