1

A mysterious entity from Google is checking out our site from time to time, curious why. We have referrers from merlot-ops-labeling-devel.corp.google.com as well as 74.125.239.132/url (which will 404 without querystring). The 74.125. part of the IP seems to be a similar range to the Google shopping feed crawler, and the /url seems to be the redirector that middlemans you [briefly] when you click a Google SERP title. That IP spent a minute on the site and visited 5 pages, however the corp domain was 0:00 and immediate bounce. Looking at rdns, not sure if its actually Google, although the whois range says its theirs:

# host 74.125.239.132
132.239.125.74.in-addr.arpa domain name pointer nuq05s02-in-f4.1e100.net.

We had set up JSON-LD but it took literally 6 months for it to be re-accepted (just happened last week....finally). Not sure whether these visits have anything to do with QA/C or something.

So, out of curiousity, does anyone know what project/team/automation "merlot-ops-labeling-devel" or this exposed redirector IP/app would be? Perhaps it has something to do with said validation?

Improve this question
6
  • I cannot find much. Did a search for "merlot-ops-labeling-devel.corp.google.com" and there are two threads on esty.com. I did various other searches and found nothing. I went to the site/URL and got a Google single sign-on. The only thing I get so far is that it seems to hit online store fronts. It seems like too new of a mystery for details. 74.125.239.132 is an internal IP address block for Google and I have no record of any accesses from this IP and I am sure it is not a part of their search. Could be a research project?? Particular to shopping perhaps??
    – closetnoc
    May 13 '15 at 21:37
  • @closetnoc thanks for looking brother. It's def Googles in house portal...after some crawling you can surface screens of "moma". Seems like internal social network, but they must have apps on various sub->subs. In those etsy threads a couple OPs said the session had orders, that's what really threw me off. I like the idea of the "labeling" part of the subdomains though... As long as it's a good label haha
    – dhaupin
    May 13 '15 at 21:54
  • The "moma" thing looks like a single sign-on that is common in large organizations used to access any and all internal services. This is what we did in BT. It allowed for additional security measures that cannot be managed any other way. Essentially, all systems look to the single sign-on rather than internal system authorization. This allowed for access by profiles that say a financials personnel would gain access to the appropriate systems at the appropriate level. In our case, security was primarily based upon HR records and the roles and responsibilities of the job.
    – closetnoc
    May 13 '15 at 22:32
  • This is a bit out there... but... code.google.com/p/merlot I thought I would inform you of it anyway!!
    – closetnoc
    May 13 '15 at 22:46
  • I am not that computer savy so much of the info in these post are difficult for me to understand. I too have been seeing this address in my traffic stats on Etsy.Is it something that can access personal information from my shop? Is it something to be concerned over?
    – user52592
    May 20 '15 at 23:52
1

To begin with any URL that shows up under corp.google.com is an internal URL used by Google staff. Having taken a look at Google Merlot the only information I can find is that it is a project management framework that Google has released under the GNU GPL v2 license although this would seem to preclude its use in accessing public websites. The only thing that could make sense as there seems to be a few people out there who have seen that host name in their server logs is that it is possible that internally Google has a project running under the merlot-ops-labeling-devel host which is used for some internal task to do with public websites, such as an audit of the website, compliance check, manual check, etc.

As it can be positively confirmed that the domain is in fact used and operated by Google I feel confident in saying there is no need to be overly concerned about it and that it does not appear to be a malicious breach access on your site. Furthermore as was mentioned by dhaupin in comments they would not be able to access any further information from your site than what a member of the public could access on your site.

Shouldn't be too much of an issue, if you still feel concerned and feel that this shouldn't be happening you can add a .htaccess rule to block that referrer from accessing your site but at this point I don't think that this would be strictly speaking necessary.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.