Intercepted Google, Virus, Malware or just sheer Paranoia?

[Satcommlee]

Hi,

I'm puzzled by one thing..

I have had a few issues with google lately, ie: being slow to load etc..

But I have looked into it and discovered the IP address for www.google.com resolves to an IP address owned by CAT telecom. (Even when using googles own DNS servers)

C:\Users\Lee>nslookup www.google.com

Server: google-public-dns-a.google.com

Address: 8.8.8.8

Non-authoritative answer:

Name: www.google.com

Addresses: 2404:6800:4001:c01::6a

61.19.1.118

61.19.1.88

61.19.1.104

61.19.1.119

61.19.1.103

61.19.1.114

61.19.1.123

61.19.1.109

61.19.1.93

61.19.1.98

61.19.1.113

61.19.1.84

61.19.1.89

61.19.1.108

61.19.1.94

61.19.1.99

All this address range points to CAT telecom (Thailand)

61.19.1.118 - Geo Information

IP Address 61.19.1.118

Host 61.19.1.118

Location TH, Thailand

City -, - -

Organization CAT TELECOM Data Comm. Dept, Intrenet Office ISP CAT Telecom public company Ltd

Now I may be paranoid here but when I try similar test on my mobile using AIS, it gets pointed Google IP address's?

I would like to see if any fellow board members can concur these results by using the command

nslookup www.google.com

My ISP is True and I am on DOCSIS3.0

I have a horrible feeling Big Brother is watching me!!

Edited August 26, 2013 by Satcommlee

[Chicog]

Why don't you try a traceroute ?

[wpcoe]

I'm also using True DOCSIS (cable) internet and out of curiosity tried a tracert:

C:\>tracert www.google.com

Tracing route to www.google.com [74.125.135.103]
over a maximum of 30 hops:

1 10 ms 8 ms 8 ms 10.20.xx.xx
2 12 ms 11 ms 13 ms 10.92.238.237
3 18 ms 69 ms 16 ms 119-46-119-14.static.asianet.co.th [119.46.119.14]
4 15 ms 12 ms 12 ms 119-46-119-57.static.asianet.co.th [119.46.119.57]
5 13 ms 12 ms 11 ms 61-91-213-225.static.asianet.co.th [61.91.213.225]
6 17 ms 12 ms 13 ms 61-91-213-35.static.asianet.co.th [61.91.213.35]
7 14 ms 13 ms 17 ms 61-91-213-81.static.asianet.co.th [61.91.213.81]
8 14 ms 18 ms 16 ms tig-net242-49.trueintergateway.com [113.21.242.49]
9 35 ms 41 ms 38 ms 72.14.215.181
10 38 ms 39 ms 39 ms 209.85.242.244
11 41 ms 39 ms 39 ms 209.85.250.237
12 * * * Request timed out.
13 37 ms 36 ms 39 ms ni-in-f103.1e100.net [74.125.135.103]

Trace complete.

Seems to do a bit of bouncing around within Thailand, but eventually finds its way to Google in Mountain View CA, USA.

[AyG]

This is perfectly normal. Google has something called "Google Global Cache". Google keeps local copies of its web pages at selected ISPs so that the pages can be served "in country", rather than having to go all the way across the ocean (unless, of course, the page contents have changed, in which case the request is passed on to Google central). This saves on international bandwidth costs for the ISP and improves response times for the user. Google Global Cache is described further at https://peering.google.com/about/faq.html

[turgid]

I'm using True for Mobile and Home internet.

I had several Google searches for a reputable Thai company divert me to a gambling site this morning using a dolphin browser on Android. The same search and links in Android Firefox take me to the correct site.

Ive also had several periods of being unable to connect to Thai visa both from my mobile and Desktop PC in the last 24 hours. But its not the normal site not found error but some weird caching error.

[siam2007]

Why don't you try a traceroute ?

how to perform such a thing ?

[Chicog]

http://www.yougetsignal.com/tools/visual-tracert/

[AyG]

http://www.yougetsignal.com/tools/visual-tracert/

Sorry, that website's absolute <deleted>. It doesn't do a proper tracert - every route shown is via yougetsignal.com, and bears no relationship to the actual route used in real life.

To do it properly go to a command prompt/DOS shell/terminal session (or whatever it's called in your particular operating system), then type tracert or traceroute (depends on operating system) followed by the target website address. E.g.

>tracert www.google.com

[Satcommlee]

I done the traceroute, directed me straight to CAT servers.. I did not get the same result as the previous poster, it did not get to the true internet gateway. It went straight from Asianet to CAT.

I'm not at home now to replicate it.

[keeniau96]

I had a very straightforward traceroute using my TOT WiNet connection in Phuket

xx@xox ~ $ traceroute 8.8.8.8

traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets

1 192.168.1.20 (192.168.1.20) 0.312 ms 0.653 ms 0.646 ms

2 node-f0h.pool-1-0.dynamic.totbb.net (1.0.204.1) 24.168 ms 24.171 ms 24.165 ms

3 172.17.53.1 (172.17.53.1) 24.923 ms 24.923 ms 25.889 ms

4 ten-0-6-1-0.cwt-core-03.totisp.net (203.114.118.153) 39.297 ms 39.691 ms 39.288 ms

5 ten-gi-8-3.cwt-gw-01.totisp.net (203.114.118.206) 40.624 ms ten-3-4.cwt-gw-01.totisp.net (203.114.118.142) 41.062 ms ten-1-4.cwt-gw-01.totisp.net (203.114.118.178) 43.685 ms

6 180.180.255.77 (180.180.255.77) 48.627 ms 180.180.255.81 (180.180.255.81) 70.550 ms 40.738 ms

7 180.180.255.42 (180.180.255.42) 55.473 ms 180.180.255.46 (180.180.255.46) 55.831 ms 180.180.255.42 (180.180.255.42) 55.448 ms

8 180.180.249.165 (180.180.249.165) 55.424 ms 58.788 ms 58.770 ms

9 180.180.249.165 (180.180.249.165) 58.329 ms 180.180.255.113 (180.180.255.113) 58.309 ms 180.180.255.105 (180.180.255.105) 55.770 ms

10 72.14.220.54 (72.14.220.54) 68.544 ms 68.544 ms 68.897 ms

11 209.85.242.238 (209.85.242.238) 66.058 ms 66.058 ms 48.663 ms

12 209.85.242.244 (209.85.242.244) 63.082 ms 63.354 ms 209.85.242.236 (209.85.242.236) 63.073 ms

13 209.85.242.125 (209.85.242.125) 63.067 ms 209.85.250.255 (209.85.250.255) 65.614 ms 209.85.250.237 (209.85.250.237) 65.613 ms

14 * * *

15 google-public-dns-a.google.com (8.8.8.8) 71.696 ms 72.083 ms 71.667 ms

xx@xox ~ $