topic Re: Google-Search display captcha in General Topics

Google-Search display captcha

Ketchup — Wed, 16 Sep 2015 17:46:09 GMT

Hello all

Our users getting more and more captcha-messages on google-search with the following explanation:
https://support.google.com/websearch/answer/86640?hl=en

After entering the captcha, google-search works for a while an then the same message is displayed again.

We have a NAT pool of several public ip addresses and configured outgoing ssl-decryption.
Does anybody have solution to block this 'unusal traffic' or at least to detect it with palo?

Re: Google-Search display captcha

preskok — Sun, 20 Sep 2015 19:37:40 GMT

we are using Virtual Wire configuration

Re: Google-Search display captcha

reaper — Mon, 21 Sep 2015 08:46:44 GMT

Have you made sure the security policy used by your outbound traffic has been configured to use a full set of security profiles?

If no malicious outbound traffic is being detected, it may be good to take a look at the botnet reports, these may containt reports on traffic that can be considered suspicious but not necessarily malicious. The botnet report is generated using a set of heuristics to match odd behavior, commonly seen by a botnet command&control network. This may help shed some light on why google is reporting

Re: Google-Search display captcha

Remo — Mon, 28 Sep 2015 06:42:26 GMT

Hi @Ketchup

Try to check in your logs if you have incomplete sessions to google ip ranges. Actually we have the same issue, and also no solution till now but I am now trying to verify why there are these incomplete sessions. Maybe this is the next step to get to a solution.

With this filter you should find the session I mean:

((addr.dst in 64.18.0.0/20) or (addr.dst in 64.233.160.0/19) or (addr.dst in 66.102.0.0/20) or (addr.dst in 66.249.80.0/20) or (addr.dst in 72.14.192.0/18) or (addr.dst in 74.125.0.0/16) or (addr.dst in 108.177.8.0/21) or (addr.dst in 173.194.0.0/16) or (addr.dst in 207.126.144.0/20) or (addr.dst in 209.85.128.0/17) or (addr.dst in 216.58.192.0/19) or (addr.dst in 216.239.32.0/19)) and (app eq incomplete)

Regards,

Remo