Googlebot trying port 21

Forum Moderators: open

Message Too Old, No Replies

Googlebot trying port 21

Peter

9:25 pm on Nov 13, 2011 (gmt 0)

Something rather strange in the firewall logs: Googlebot (from 66.249.71.97) seems to be trying to access port 21 on my server.

Four attempts today, at 15.21 and 15.23, then at 21.34 and 21.35. There is no FTP on this server, and there never has been.

Has anyone else seen this?

Peter.

dstiles

10:06 pm on Nov 14, 2011 (gmt 0)

It certainly claims to be googlebot in DNS. Hasn't hit my (SSL) FTP servers but we know google is evil... :(

SteveWh

12:25 am on Nov 17, 2011 (gmt 0)

Just a few ideas, not sure how valid they are:

Maybe Googlebot encountered a bogus ftp:// link to your site somewhere on the web, and is checking it out.

Maybe Google is doing some sort of survey about the features or security of sites on the web, including such things as availability of anonymous FTP, or something like that.

I don't know if Google employees can use the crawler server IPs to do manual web fetches, but it seems like they might have that ability. Not clear what the point of it would be in this case, though.

Elysia

3:16 pm on Mar 8, 2012 (gmt 0)

Hi all, new to the forum but was searching to find why this might be happening, and saw your topic here. I've had exactly the same issue yesterday on a VPS, where the secure log is showing 2 sets of three login anonymous FTP attempts from what appears to be googlebot, as follows: (server details anonymised for security)

Line 164878: Mar 7 10:05:42 server proftpd[3795]: server.example.com (66.249.71.116[66.249.71.116]) - USER anonymous: no such user found from 66.249.71.116 [66.249.71.116] to (IP address removed):21

Line 164879: Mar 7 10:05:42 server proftpd[3795]: server.example.com (66.249.71.116[66.249.71.116]) - mod_delay/0.5: delaying for 121 usecs

Line 164880: Mar 7 10:05:42 server proftpd[3795]: server.example.com (66.249.71.116[66.249.71.116]) - FTP session closed.

Line 164882: Mar 7 10:05:42 server proftpd[3796]: server.example.com (66.249.71.116[66.249.71.116]) - USER anonymous: no such user found from 66.249.71.116 [66.249.71.116] to (IP address removed):21

Line 164883: Mar 7 10:05:42 server proftpd[3796]: server.example.com (66.249.71.116[66.249.71.116]) - mod_delay/0.5: delaying for 74 usecs

Line 164884: Mar 7 10:05:42 server proftpd[3796]: server.example.com (66.249.71.116[66.249.71.116]) - FTP session closed.

66.249.71.116 appears to be crawl-66-249-71-116.googlebot.com but I'm puzzled why a search bot should be attempting an FTP login on a VPS. Is googlebot's IP address being spoofed?