3

I'm subscribed to goverment's owned ISP because only this ISP provides access to rural area. It has a bad reputation because it is not only redirects sites, but also injects JavaScript for advertising at the end of HTML pages.

I've been using dnscrypt to avoid redirection. But a few hours ago, I accidentally discovered that DNS request for www.google.com resolved to 118.98.111.30. I'm using OpenDNS as a provider for dnscrypt-proxy.

A quick whois shows that the IP is owned by my ISP. After restarting my home routers and PCs, DNS requests for www.google.com return IP owned by Google and never return 118.98.111.30 again.

I would like to know what I can do to determine that this IP is part of Google's CDN or some kind of rogue site?

3 Answers 3

5

You might have hit the "Google Global Cache" where servers are placed on your ISPs network to provide lower-latency access to commonly used resources. The fact that visiting that IP address in a browser gives the Google search page reinforces this likelihood.

As for trusting IP addresses: don't. Always use protocols protected by strong end-to-end encryption (TLS) and rely on the certificates presented. While they might not be perfect (they're not!), the TLS infrastructure is a lot better than trying to be reassured about DNS. (Though dnscrypt and/or DNSSEC can offer some reassurances in the DNS space as well, they're not widely deployed.)

2

This ip, when accessed through https, provides a valid certificate for Google.com, so either this server is managed by Google or the ISP is doing a passthrough for HTTPS. Given that it serves a google certificate when accessing by ip, I lean towards it being a Google server.

In both cases, using https will ensure that you are communicating with the real Google¹ no matter if they are proxying your DNS or not.

Note that even if they don't poison your DNS, they can still snoop and modify all your http: pages, so you always need the https layer.

¹ I am assuming your ISP hasn't compromised a Google certificate and uses that to MiTM its customers :)

0

When you aren't sure you can trust your ISP, use the HTTPS version of google. When they try to redirect your request to a fake site, you will get a warning that the certificate isn't valid.

You should in fact do this for any website. The browser extension HTTPS everywhere can help you with this. It automatically redirects you to the HTTPS version of a website when available. Using HTTPS also prevents any code injection, by the way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .