Google Captcha

Fri Sep 14 21:20:46 UTC 2018

- Not being signed in to a Google account with a verified phone number

- Searching complex things that look like dorks ("powered by vbulletin",
  "xxx v0.0.1", etc), can trigger within a page or two sometimes
- Does this end user lease any IPs from brokers or otherwise? -  on
  extremely, very, very dirty/dangerous/bad netblocks used almost
  entirely for fraud, bots, ddos, etc before (google Methbot; example of
  a few that almost certainly gets high risk penalized on everything:
  https://bgp.he.net/search?search%5Bsearch%5D=%22Cloud+innovation%22+or+%22cloudinnovation%22+or+%22larus%22+or+%22netstack%22+or+%22DET+Africa%22+or+%22Digital+Energy%22+or+%22GZ+Systems%22&commit=Search
  )

- Blocking cookies

- Malware using you as a proxy is also a thing - a lot of the proxy
  sellers (google for backconnect, reverse backconnect, etc) entirely
  run off malware, botnet, etc. They are often used for checkout/stolen
  credit cards/"carding"/L7 http flooding services such as Shopify and
  Nike. This will result in extremely persistent "bans" from recaptcha
  because virtually all of these checkout sites utilise it

On Fri, Sep 14, 2018, at 9:31 AM, Justin Wilson wrote:
> In the experience of the community what causes the “Unusual traffic”
> messages when doing google searches? This ISP network hands out public
> IP addresses to each and every customer. No batting going on.  Does
> Google typically drop entire /24’s into this if they see an issue?
> The initial troubleshooting we have done involves disconnecting the
> customer router and going direct with a laptop.  Still the same
> captcha.  We clock “I am not a robot” and the search goes through, but
> it re-appaers the next search.> 
> Looking for a direction to look.  What typically causes this? I know
> what the page says, but looking for specifics.> 
> Thanks
> 
> 
> Justin Wilson
> j2sw at mtin.net
> 
> www.mtin.net
> www.midwest-ix.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20180914/28eef787/attachment.html>