Is the Google address being spoofed on my computer?

Question

I might use some inappropriate terminology because I am no expert, but please feel free to correct me where it is needed.

I believe that a process has modified some network file on my computer, like the hosts file, in order to reroute my Google searches. The reason I say this is because I have a very fast internet connection and every website loads up very quickly, except for Google. The other possibility I can think of is that Google's server is operating slowly, but it seems to be fine when I do searches on my phone.

Now, I don't mean just a little bit slower, but in the range of taking up to a minute to load; this is seems to me to be very odd behavior. I have also checked my host file at "C:/Windows/System32/Drivers/Etc/hosts" and it seems to be fine.

I would like to know the opinion of someone else.

Behavior Information

• When trying to load www.google.com the page takes longer than 1 minute to load
• www.Google.ca loads perfectly normal and quite fast.
• other webpages load at a normal speed (less than 5 seconds).
• When pinging "www.google.com" the packets time out
• When pinging "maps.google.ca" the packets return promptly
• When pinging "www.google.com" the address that is pinged is "[2607:f8b0:4009:801::1011]"

Update

• If I add the line "74.125.227.144 www.google.com" into the hosts file, then Google loads fine; mind you, this is not a fix--I still would like to know what's going on and fix the problem.

Answer 1

Most likely not. IPv6 support is still quite patchy in many parts of the world. The delay is most likely caused by bad routing or network packets having to go through too many hops. You can test out your IPv6 connection here.

The hosts file is used to bypass DNS and make your access to websites matching domains listed slightly faster, not slower.

A whois lookup on 2607:f8b0:4009:801::1011 shows that the address belongs to Google Inc. Hackers would most likely direct you to a site they own or control, in which case, it wouldn't be Google.

To avoid the situation of websites taking longer time to load, you can turn off IPv6 on your network configuration setting to prevent DNS from resolving to an IPv6 address. Further, if you are using DNS servers from your ISP, you can try change them to Google's DNS servers on 8.8.4.4 or 8.8.8.8 as they seem to be more reliable.

For verification of the Google website, access using HTTPS and follow the detailed instructions given in thexacre's answer above.

Answer 2

These days Google uses HTTPS even for their search, which makes it relatively easy for you to verify that your connection is secure. This does not absolutely grantee that your connection isn't being rerouted by an attacker, but it does guarantee they're not able to view or manipulate your traffic and therefore the attacker would have little motivation to do so.

The process to verify that your connection is secure depends on your browser, but for example in Chrome:

Note: It's possible your certificate will have a different parent certificate from mine below, if so check the certificate against the ones listed here. In my example the certificate has been signed by the "Older GeoTrust Global CA cross-signed Google Internet Authority G2".

First make sure there's a "padlock" and that the domain is a legitimate Google owned domain.

Next, click the lock, go to Connection, click "Certificate Information" click the Details Tab.

At the time of writing under the "certificate hierarchy" you should see a certificate called "Google Internet Authority G2" above "*.google.com". If you click the "Google Internet Authority G2" certificate and go down to "SHA-1 fingerprint" you should get the value of:

D8 3C 1A 7F 4D 04 46 BB 20 81 B8 1A 16 70 F8 18 34 51 CA 24

Or alternatively:

BB DC E1 3E 9D 53 7A 52 29 91 5C B1 23 C7 AA B0 A8 55 E7 98

Checking the certificate fingerprint as above will ensure an attacker hasn't installed a malicious CA certificate on your machine, and that someone hasn't managed to get a malicious certificate signed for *.google.com (which would be a huge worldwide security issue).

If the certificate checks out then your connection should be secure from an information security standpoint (assuming the integrity of your browser client has not been compromised), you then might need to start looking for other causes for what you're experiencing. Diagnosing network routing issues is probably outside the scope of this SE site, but you could start with a traceroute/tracert.