Re: Google "unusual traffic" captcha

["Carson, Larry" <larry.carson () UBC CA>]

I saw it yesterday when I was running searches on web shells but specifically for our domains. It must have popped up 
at least 5 times.


Regards,
Larry Carson
Associate Director, Information Security Management, UBC


-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Kevin 
Halgren
Sent: September 11, 2015 9:11 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Google "unusual traffic" captcha

We've seen this on a NAT address for our Library towards end of semester before.  I'm guessing it's because it was a 
NAT address to it looked like a single IP and a lot of students were doing Google searches related to assignments, 
papers, etc.

Kevin

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of 
Blackwood, James
Sent: Thursday, September 10, 2015 11:09 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Google "unusual traffic" captcha

We’ve been getting this off and on for the past couple of days.  I’ve seen it once before a year or two ago but it 
resolved itself.  I get that there must be something on our network that Google has decided is making automated search 
requests which is a violation of their terms of service.  

I created a port monitor on our internet firewall and looked at the traffic destined for 215.58.219.164 (www.google.com 
based on my DNS lookup) using WireShark and see, as expected, a ton of traffic but not necessarily a ton of traffic 
from a single host.  Does anyone have any pointers on what specifically to look for?

Thanks,
James

James Blackwood 
Director of Information Technology
Chief Security Officer
LaGrange College

(706) 880-8050  phone
(706) 880-8055 fax
jblackwood () lagrange edu

601 Broad St., LaGrange, GA 30240
www.lagrange.edu

Attachment: smime.p7s
Description: