Bruce123 Posted January 19, 2017 Posted January 19, 2017 We seem to get getting an increasing occurrence of the Google search Captcha (robot check) recently. Has anyone else noticed it? Most users probably experiences it at least once or twice per day... We've tried contacting Google to see if they can give us some indication of the trigger in our case, but they won't help as they explained that Google Search "is provided free and unsupported". We do use Google Apps, but that doesn't seem to help in the level of support we get for Google Search. There are articles on possible causes (e.g. top 10 causes), but it doesn't really help us very much without being able to arrow it down a little. We have recently enabled Safe Search on our Google domain, but I doubt if that can be related. I suspect it could be due to the devices on our BYOD wireless network (only ports 80 and 443 allowed out to the Internet), but who knows... Any thoughts? Kind Regards, Bruce.
FN-GM Posted January 19, 2017 Posted January 19, 2017 Someone on here had it when they set IE search to default to Google. But they made a mistake in the config string (or whatever its called) so any searches are repeated multiple times.
6Foot2 Posted January 19, 2017 Posted January 19, 2017 We see this occasionally during holidays when network traffic is (comparatively) low: Any unexpected increases in traffic is, apparently, a cause for suspicion. This happens to other schools using the same LEA/ISP. Do other schools near you see the same issue at the same time?
mjk Posted January 20, 2017 Posted January 20, 2017 This is quite a helpful thread: http://www.edugeek.net/forums/cloud-services/162763-whats-going-google-today-getting-loads-captchas-when-surfing.html If you are doing deep packet inspection, keep a lookout for hola_get https://isc.sans.edu/forums/Google+Hola+VPN+and+quotUnusual+traffic+from+your+computer+networkquot/1053/
Bruce123 Posted February 3, 2017 Author Posted February 3, 2017 We see this occasionally during holidays when network traffic is (comparatively) low: Any unexpected increases in traffic is, apparently, a cause for suspicion. This happens to other schools using the same LEA/ISP. Do other schools near you see the same issue at the same time? It's an FE College with 4 internet connections to Janet (3x 1Gbit and 1x100Mibt), and each connection has a public IP, which isn't shared with anyone else. Having read the article posted at the end, I think it could be due to particular apps installed on user's own BOYD devices or particular Chrome extensions (on domain joined desktops or Chrome devices). The problem is, I imagine it's quite hard to identify the cause(s), and I can only see this problem getting worse... Thanks, Bruce.
Arthur Posted February 8, 2017 Posted February 8, 2017 We've tried contacting Google to see if they can give us some indication of the trigger Interesting article from last week... Google mistakes the entire NHS for massive cyber-attacking botnet Google is blocking access to the entire NHS network, mistaking the amount of traffic it is currently receiving as a cyber attack. An email from an NHS trust's IT department seen by The Register confirmed that the US search giant has mistaken the current traffic levels for a botnet. The email headed "Google Access" stated: "Google is intermittently blocking access due to the amount of traffic from NHS Trusts Nationally (This is not being blocked by the IT Department). "This is causing Google to think it is suffering from a cyber-attack. "We are advising staff to use an alternative search engine i.e. Bing to bypass this problem. "If you have 'Chrome' on your desktop the page will display correctly but if you 'should' get a CAPTCHA pop up, please follow the instructions to continue." An NHS Digital spokesman contacted The Reg to say: “We are aware of the current issue concerning NHS IP addresses which occasionally results in users being directed to a simple verification form when accessing Google. This would appear to be due to the high number of people using our systems and trying to access Google at peak times. We are currently in discussion with Google as to how we can help them to resolve the issue.”
PotNoodleTech Posted February 9, 2017 Posted February 9, 2017 Yes LEA's are having the same problem - google have made some changes recently which seems to have lost their "whitelist" of massive networks that are trustworthy. Our LEA have said they are in discussion with google too so hopefully it can be resolved.
mjk Posted February 9, 2017 Posted February 9, 2017 This would appear to be due to the high number of people using our systems and trying to access Google at peak times. We are currently in discussion with Google as to how we can help them to resolve the issue.” That was our first thought with 1500 simultaneous connections to Google through a single IP address, but after speaking to Google it was clear that this wasn't the case (it's peanuts) and we were getting blocked due to a url rewrite condition forcing safesearch. Sometime the 'obvious' answer isn't the correct one.
FN-GM Posted February 9, 2017 Posted February 9, 2017 How do you contact google if you have these issues? I don't have any now, but have in the past, but I was unable to contact them.
mjk Posted February 9, 2017 Posted February 9, 2017 How do you contact google if you have these issues? I don't have any now, but have in the past, but I was unable to contact them. As a customer we can create support requests via Google Suite.
fiza Posted April 19, 2017 Posted April 19, 2017 Did anybody get this resolved? We moved to Smoothwall for our filtering over the holidays and yesterday was our first full day of school. Today our users are getting the captcha continuously and cannot do anything on the net. Any help to resolve this would be appreciated.
mjk Posted April 19, 2017 Posted April 19, 2017 Did anybody get this resolved? We moved to Smoothwall for our filtering over the holidays and yesterday was our first full day of school. Today our users are getting the captcha continuously and cannot do anything on the net. Any help to resolve this would be appreciated. Yes we resolved this problem, it was caused by an ancient URL rewrite condition which we were using to force safesearch. When we updated the url rewrite the captcha disappeared overnight and has not returned.
fiza Posted April 19, 2017 Posted April 19, 2017 Yes we resolved this problem, it was caused by an ancient URL rewrite condition which we were using to force safesearch. When we updated the url rewrite the captcha disappeared overnight and has not returned. @mjk - Where was this URL rewrite? was it a smoothwall issue or specific to your environment?
mjk Posted April 19, 2017 Posted April 19, 2017 @mjk - Where was this URL rewrite? was it a smoothwall issue or specific to your environment? I think it was a browser re-write url and not on smoothwall - It was a hack that wasn't recommended by Google So yes it was specific to our environment. We also asked Smoothwall to login and help diagnose the problem - they did find tens of thousands of hits from the hola ( what happens is that if you block hola the app then sends out a request to google to see if there is internet access, it then tries hola again which is blocked so it tries google again ad infinitum. ) We blocked the hola_get on our wifi but it was only when we removed the url rewrite the problem went away.
fiza Posted April 27, 2017 Posted April 27, 2017 Today we are getting the "Our systems have detected unusual traffic" but with no option for ticking 'I am not a robot'. This has completely crippled Google for us and we are having to go with bing.com Has anyone else seen this?
6Foot2 Posted April 27, 2017 Posted April 27, 2017 ...Has anyone else seen this? In the words of another place I used to call to compare experience/eliminate possible local only effects: No problems here. *Call terminated at the other end. Thanks VERY much!
mjk Posted April 27, 2017 Posted April 27, 2017 Today we are getting the "Our systems have detected unusual traffic" but with no option for ticking 'I am not a robot'. This has completely crippled Google for us and we are having to go with bing.com Has anyone else seen this? You are going to have to start monitoring your traffic to Google. Once you've eliminated any spurious rewrites start fire up tcpdump on the smoothwall box or ask smoothwall for help
fiza Posted April 27, 2017 Posted April 27, 2017 You are going to have to start monitoring your traffic to Google. Once you've eliminated any spurious rewrites start fire up tcpdump on the smoothwall box or ask smoothwall for help Strangely it's all started working again now. No captcha at all for the last hour or so. Google search working as it should be.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now