Upon further investigation, in this particular Google case, it seems to be a customer's CNAME to a record of theirs which is an actual A record to our old IP, contrary to our instructions (we tell everyone to CNAME us, so we can change IPs as we wish, which we've done for the first time this year). So there is no Google problem. -----Original Message----- From: "Erik Levinson" <erik.levinson@uberflip.com> Sent: Thursday, January 17, 2013 8:42pm To: "Damian Menscher" <damian@google.com> Cc: "NANOG mailing list" <nanog@nanog.org> Subject: Re: Intermittent incorrect DNS resolution? Thanks Damian. I see four requests with Google UAs from actual Google IPs, 66.249.73.45 and 66.249.73.17 (PTR and rwhois seem yours for both), in a period of 30 minutes (compared to over 80 per minute on the new IPs). This is pretty low, so I'm not too worried. Baidu is the main culprit now; there's little other traffic. In fact, we're getting no traffic from Baidu on the new IPs, only to the old ones. I've already e-mailed their spider help e-mail, but it's fallen on deaf ears. Erik -----Original Message----- From: "Damian Menscher" <damian@google.com> Sent: Thursday, January 17, 2013 1:58pm To: "Erik Levinson" <erik.levinson@uberflip.com> Cc: "NANOG mailing list" <nanog@nanog.org> Subject: Re: Intermittent incorrect DNS resolution? On Wed, Jan 16, 2013 at 8:09 PM, Erik Levinson <erik.levinson@uberflip.com>wrote:
To give an idea of the scale of the problem right now, I'm getting thousands of requests per minute to a new IP vs. about two requests per minute on the equivalent old IP, with over 60% of the latter being Baidu, but also a bit of Googlebot and other random bot and non-bot UAs.
It's common for malware to spoof the Googlebot user-agent since they know most webmasters won't block it. You might want to check whether the IPs you're seeing it from are really allocated to us -- if so, I'd be interested in tracking down why we're crawling your old IP. Damian