I am not sure if this is actually an issue or not or if I am just being too paranoid, but I noticed this upon arriving home to Alaska recently (location is important as you'll see shortly). In short, I installed a tool called PeerBlock which blocks connections to advertising and malicious servers (and also has a particular dislike for educational, ISP and government servers) while I was away and noticed something strange when I got back. Google and Youtube connections were being blocked by PeerBlock under the basis of it being "Alaska Communications Systems Group, Inc", which is my ISP.
The result was dozens of messages like this in its log, note the time stamp showing how many happen at once:
Now I have seen in the past PeerBlock block various websites for silly reasons simply because of what they use for hosting, so I did not take this without a grain of salt. I decided to look into it a bit more by running the command
dig @18.104.22.168 google.com on one of my Linux machines and got the following result:
; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> @22.214.171.124 google.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13297 ;; flags: qr rd ra; QUERY: 1, ANSWER: 15, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;google.com. IN A ;; ANSWER SECTION: google.com. 299 IN A 126.96.36.199 google.com. 299 IN A 188.8.131.52 google.com. 299 IN A 184.108.40.206 google.com. 299 IN A 220.127.116.11 google.com. 299 IN A 18.104.22.168 google.com. 299 IN A 22.214.171.124 google.com. 299 IN A 126.96.36.199 google.com. 299 IN A 188.8.131.52 google.com. 299 IN A 184.108.40.206 google.com. 299 IN A 220.127.116.11 google.com. 299 IN A 18.104.22.168 google.com. 299 IN A 22.214.171.124 google.com. 299 IN A 126.96.36.199 google.com. 299 IN A 188.8.131.52 google.com. 299 IN A 184.108.40.206 ;; Query time: 118 msec ;; SERVER: 220.127.116.11#53(18.104.22.168) ;; WHEN: Sun Apr 24 13:32:34 AKDT 2016 ;; MSG SIZE rcvd: 279
22.214.171.124 was used as that is the nameserver my main computer uses as well, not the router's or anything.
Now at this point I was a bit concerned, as indeed the IP range
126.96.36.199/24 reported by DiG is owned by ACS as seen here, and I doubt that page has inaccurate information.
I asked some of my friends as well to see if this was a common thing (Google somehow reporting ISP A records like that as it didn't happen where I was from previously), and they all showed that using
188.8.131.52 as well they got actual Google-owned IP ranges.
The odd thing too is that visiting Google by disabling PeerBlock still shows a valid SSL certificate, so I do not think the information I send is being monitored or anything unless there is some way to fake the authenticity of a SSL cert via MITM without having some sort of client side program changing what the browser thinks is valid as far as I know.
Is this something to be concerned about (as mind you, this only happens with Google which is a bit suspicious), or is this a common thing ISPs do? Or perhaps is this just Google taking advantage of the ISP's servers to provide better response times to people living so far away from most servers due to the physical location?