126

I see my PC has TCP connections open to 1e100.net. Then I checked the whois record and find it is registered to Google. Weird.

A quick search seems to indicate that 1e100.net is pretty popular - about the same reach as adobe.com or bbc.co.uk according to Alexa - but what is it? I run Chrome so I assume it might have something to do with that, but why is there so little information about it?

5

3 Answers 3

91

It's Google Safebrowsing feature in Chrome.

That feature checking sites and tell you if that site is "Attack Site"

sinni800: @MicTech, Google has all it's search servers under the 1e100 domain. I know this is kind of late but w/e. It does not ONLY relate to google safe browsing.

13
  • 65
    ... and tells Google what you're browsing. Nov 29, 2009 at 14:12
  • 15
    Google Safe Browsing Policy: google.com/intl/en_us/privacy_browsing.html "When you visit a site that we think could be a phishing or malware site, your browser will send Google a hashed, partial copy of the site’s URL so that we can send more information to your browser. Google cannot determine the real URL from this information."
    – Alan B
    Feb 8, 2010 at 10:14
  • 8
    @MicTech, Google has all it's search servers under the 1e100 domain. I know this is kind of late but w/e. It does not ONLY relate to google safe browsing.
    – sinni800
    Aug 19, 2011 at 9:06
  • 8
    @AlanB That policy makes sense only when you don't think about it. If it couldn't "determine the real URL from this information", then how the heck could it tell if it's a phishing/malware site? Besides, "partial copy of the site's URL" could mean anything, and I bet it at least contains the full domain name. Bottom line: Google can know all the sites you visit unless they really don't wanted to (which frankly doesn't seem the case). Jan 31, 2012 at 9:08
  • 4
    Why do the connections stay open (in System Process) long after I closed Chrome? Jul 25, 2012 at 21:46
21

From Google Help:

1e100.net is a Google-owned domain name used to identify the servers in our network.

Following standard industry practice, we make sure each IP address has a corresponding hostname. In October 2009, we started using a single domain name to identify our servers across all Google products, rather than use different product domains such as youtube.com, blogger.com, and google.com. We did this for two reasons: first, to keep things simpler, and second, to proactively improve security by protecting against potential threats such as cross-site scripting attacks.

Most typical Internet users will never see 1e100.net, but we picked a Googley name for it just in case (1e100 is scientific notation for 1 googol).

1
  • 1
    Correct. You could also add that the connections stay open probably due to HTTP persistent connections. Mar 7, 2016 at 12:28
21

Here is the truth. Google tracks you, me and everybody!

Lots of Google services use 1e100.net but that doesn't mean 1e100 is just for the services you want to have. For example Google safebrowsing feature(or I should say snitch) is being used no matter what you choose. Even if you disable any option on chrome to prevent safebrowsing, you will still have lots of connections to 1e100.net.

I have been trying to block all connections to 1e100.net but no luck! If you are using Google Chrome or any other Chrome based browser (Comodo Dragon, Yandex Browser and so on), your browser WILL send the URL you are visiting to Google. Even if you tell Chrome not to do that!

You can confirm that with these steps:

  1. Download and install Comodo Dragon(to test any Chrome based browser do that, of course Google Chrome also does that).
  2. Uncheck all checkboxes under the Privacy section in the Setting tab.
  3. Change default search engine for omnibox(you can use duckduckgo or something else).
  4. Type an URL into address bar and chrome immediately inform 1e100.net about the URL you are about to visit!

Here is the screenshot from Comodo Killswitch after I did those steps: enter image description here

Not only that, GoogleUpdate.exe will run and send some more information EVEN IF chrome is closed and GoogleUpdate service is DISABLED!

I used Comodo Firewall the block 1e100.net and guess what, Chrome still find a way to open connection and send data to 1e100.net! It even pass through firewall. I don't know how but it does! then I found that Chrome uses IP addresses to access 1e100.net services, not domain name! That's a clever way to get through firewalls. Since there is huge number of IP addresses belonging to 1e100.net, it becames impossible to block it by IP addresses. On the other way, so other services also use 1e100.net which makes blocking 1e100.net resulting in also blocking some google services (maps, gmail, etc).

Google started with the motto "Don't be evil" but I say, "Don't be evil, says the devil".

I recommend to use Firefox as browser (of course you will still need to disable safebrowing in Firefox) and stop using Google products. I know it is a painful experience to do it but it had to be done!

4
  • 6
    Lol @ "Here is the truth." If a person doesn't know that Google [very efficiently] tracks them, then they live under a rock. It's how their advertising engine knows how to target you. Jul 22, 2015 at 14:37
  • 2
    @aggregate1166877 except it didn't know how to target me, which is why I have a firewall on my cellphone in the first place. A Chinese phone operator for a Czech guy? C'mon... Nov 11, 2015 at 10:46
  • 3
    @JanDvorak, google can spy on you even if you use a firewall. Google uses cookies to track people, which is allowed by firewall because it's considered an HTTP traffic. Dec 4, 2015 at 15:54
  • 4
    The worst of 1e100.net connections is that they're wide open, no SSL. At least last time I've monitored them. Saw a lot of traffic for Google Drive stuff, probably backups of WhatsApp and such. For the life of me I can't understand why, of all companies, google does not use secure links for that.
    – Julius
    Sep 18, 2018 at 10:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .