1

I found this IP in my access log posting repeatedly thousands of times. Is this really GoogleBot, or is it a spammer? I hesitate to block it.

185.62.188.98 - - [13/May/2015:18:54:33 -0400] "POST /xmlrpc.php HTTP/1.0" 200 370 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"

[root@host ~]# tracepath 185.62.188.98
 1:  107.170.3.254 (107.170.3.254)                          0.740ms
 2:  192.241.164.237 (192.241.164.237)                      0.550ms
 3:  nyk-b6-link.telia.net (62.115.35.101)                  4.754ms
 4:  nyk-bb2-link.telia.net (80.91.254.37)                 23.416ms asymm  5
 5:  ash-bb4-link.telia.net (62.115.137.66)                 7.765ms
 6:  ash-b1-link.telia.net (213.155.130.73)                 9.070ms
 7:  voxility-ic-311384-ash-b3.c.telia.net (62.115.55.66)  13.089ms
 8:  no reply
 9:  no reply
10:  no reply
11:  gw-blazingfast.voxility.net (5.254.105.110)          116.693ms
12:  hosted-by.blazingfast.io (185.62.188.98)              97.844ms reached
     Resume: pmtu 65535 hops 12 back 53
Improve this question

4 Answers 4

Reset to default
2

No. It is not Google.

Google would not POST /xmlrpc.php. This may be a vulnerability probe or an attack against an existing vulnerability that may or may not exist on your site.

185.62.188.98 is hosted-by.blazingfast.io. When you see something like hosted-by as a sub-domain, it is a webhost, obviously, but also an anonymous address block where the server is protected through a semi-bogus PTR DNS record. It is not uncommon for hosted systems domain names not to match the PTR record, but generic sub-domains such as this one are more than lazy and indicate a permissive hosting company (in my book anyway). They are sometimes used by people that are up to no good. Not an indictment, just common. I have a ton of these types of sub-domains in my abuse database.

Block by IP Address:

Apache .htaccess File

RewriteCond %{REMOTE_ADDR} ^185\.62\.188\.98$ [NC]
RewriteRule .* - [F,L]

Cisco Firewall

access-list deny-185-62-188-98-32 deny ip 185.62.188.98 any
permit ip any any

Nginx

Edit nginx.conf and insert include blockips.conf; if it does not exist. Edit blockips.conf and add the following:

deny 185.62.188.98;

Microsoft IIS Web Server

<rule name="abort ip address 185.62.188.98/32" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^185\.62\.188\.98$" />
  </conditions>
 <action type="AbortRequest" />
</rule>

Windows netsh ADVFirewall Firewall

netsh advfirewall firewall add rule name="block-ip-185-62-188-98-32" dir=in interface=any action=block remoteip=185.62.188.98/32
Improve this answer
6
  • Maybe this question shoul dbe made a bit more generic and then saved to the FAQ
    – Steve
    May 14, 2015 at 0:21
  • @Steve Okay. I plead ignorance! Huh?? I have to admit mostly answering questions and perhaps have not explored the site as much as I should have. ;-)
    – closetnoc
    May 14, 2015 at 0:25
  • @clostnoc No No...I am saying it is a great answer and should be preserved, but just make the question a little less IP or 'blazingfast.io' specific
    – Steve
    May 14, 2015 at 3:37
  • @Steve I got what you mean... I just didn't know there was such a thing!! Thanks for the compliment! I do appreciate it.
    – closetnoc
    May 14, 2015 at 3:50
  • Ummm...isn't there an FAQ thingy where popular questions are preserved? I am sure they have that on Stack Overflow
    – Steve
    May 14, 2015 at 4:17
1

I can agree that it definitely is NOT google at all.

This webpage http://www.whois.com/whois/185.62.188.98 tells me its from a system out in ukraine called blazingfast.

Before downright blocking the IP, you have to figure out what types of people you want to welcome to your site.

It's quite possible that someone on that network simply has a hijacked computer and if you run a site with ads and that poor user behind the hijacked computer wanted to click the ad and you block them out, then you lost a chance at revenue.

Now if you know for sure that your website is never meant for the ukraine region, then you can go ahead and block them out.

You could even pull this off in PHP if your whole web application is written in it. Just insert this code right after the opening php tag at all entry php files (such as index.php)

if ($_SERVER['REMOTE_ADDR']=="185.62.188.98"){
echo "Access denied";
exit();
}

It just basically checks for the IP address and if it matches the one you inquired on, then it prints only "access denied" to the screen.

Improve this answer
0

Google actually has a page explaining how to verify Googlebot:

To verify Googlebot as the caller:

  1. Run a reverse DNS lookup on the accessing IP address from your logs, using the host command.
  2. Verify that the domain name is in either googlebot.com or google.com
  3. Run a forward DNS lookup on the domain name retrieved in step 1 using the host command on the retrieved domain name. Verify that it is the same as the original accessing IP address from your logs.

Example 1:

> host 66.249.66.1
1.66.249.66.in-addr.arpa domain name pointer crawl-66-249-66-1.googlebot.com.

> host crawl-66-249-66-1.googlebot.com
crawl-66-249-66-1.googlebot.com has address 66.249.66.1

Usually, I let a simple script parse access.log once a day (I'm using Nginx but it shouldn't matter). It could be prettier, is not particularly strict (if an URI contained "Googlebot", for example, it would match and block a visitor IP) and is just here to illustrate the workflow:

#!/bin/sh

tmp="/tmp/fake-crawlers.tmp"
copy="/tmp/fake-crawlers.copy.tmp"
file="/etc/pf/fake-crawlers"

checkcrawler () {
    hostnme=`host $1 | cut -d ' ' -f 5`
    hostip=`host $hostnme | cut -d ' ' -f 4`
    hostmatch=`echo $hostnme | grep -E "$2" > /dev/null && echo $?`
    ipmatch=`[ "$hostip" = "$1"  ]`
    if [ "$hostmatch" = "0" ] && $ipmatch; then
        # do nothing
    else
        echo $1
    fi
}

rm $tmp $copy > /dev/null 2>&1

cp $file $copy

cat $1 | \
    grep "Googlebot" | \
    awk '{print $1}' | \
    sort -u | \
    while read ip; do
    checkcrawler $ip "(googlebot\.com|google\.com)\.$"
    done >> $tmp

cat $1 | \
    grep "bingbot" | \
    awk '{print $1}' | \
    sort -u | \
    while read ip; do
        checkcrawler $ip "search\.msn\.com\.$"
    done >> $tmp

cat $1 | \
    grep "Qwantify/" | \
    awk '{print $1}' | \
    sort -u | \
    while read ip; do
        checkcrawler $ip "search\.qwant\.com\.$"
    done >> $tmp

cat $1 | \
    grep "Applebot" | \
    awk '{print $1}' | \
    sort -u | \
    while read ip; do
        checkcrawler $ip "applebot\.apple\.com\.$"
    done >> $tmp

cat $copy $tmp | sort -u > $file

rm $tmp $copy

pfctl -t fake-crawlers -T replace -f $file

First (and only) argument is the log file. Obviously, it uses pf as a firewall but it is trivial to adapt it to any other. Every cat section is self-sufficent and can be deleted or another similar one added. The sections currently added are for crawlers where instructions for verifying exist.

Improve this answer
0

I used to get a lot of attacks from them on my servers. I blocked them via CSF firewall. If you want to block their range put this in your deny file for CSF (without the spaces):

185.11.144.0/22 # do not delete hosted-by.blazingfast.io

185.11.145.0/24 # do not delete hosted-by.blazingfast.io

185.11.146.0/24 # do not delete hosted-by.blazingfast.io

185.11.147.0/24 # do not delete hosted-by.blazingfast.io

185.61.136.0/22 # do not delete hosted-by.blazingfast.io

185.62.188.0/23 # do not delete hosted-by.blazingfast.io

185.62.188.0/24 # do not delete hosted-by.blazingfast.io

185.62.189.0/24 # do not delete hosted-by.blazingfast.io

185.62.190.0/23 # do not delete hosted-by.blazingfast.io

185.62.190.0/24 # do not delete hosted-by.blazingfast.io

185.62.191.0/24 # do not delete hosted-by.blazingfast.io

188.209.48.0/23 # do not delete hosted-by.blazingfast.io

188.209.48.0/24 # do not delete hosted-by.blazingfast.io

188.209.49.0/24 # do not delete hosted-by.blazingfast.io

188.209.50.0/23 # do not delete hosted-by.blazingfast.io

188.209.52.0/23 # do not delete hosted-by.blazingfast.io

188.209.52.0/24 # do not delete hosted-by.blazingfast.io

188.209.53.0/24 # do not delete hosted-by.blazingfast.io
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.