Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I see my PC has TCP connections open to 1e100.net. Looking at the content this seems to be a Chinese site and I immediately feared the worst re viruses/malware. Then I checked the whois record and find it is registered to...Google. Weird.

A quick search seems to indicate that 1e100.net is pretty popular - about the same reach as adobe.com or bbc.co.uk according to Alexa - but what the hell is it? I run Chrome so assume it might have something to do with that, but why all the Chinese and why does so little information appear on the web about it?

Edit: Ie100.net != 1e100.net - explains the Chinese!

share|improve this question
1e100 means 1 E 100. 1 * 10 ^ 100. The number, which is named Googol, where Google gets the name from. –  brandstaetter Nov 27 '09 at 9:02
en.wikipedia.org/wiki/Googol for further reading –  brandstaetter Nov 27 '09 at 9:03
@brandstaetter Yes, I got the googol reference when I saw the whois record. Neat :) –  Lunatik Nov 27 '09 at 9:19
Note: Pinging Google yields this domain in replies. –  Nathan Osman Jan 30 '11 at 3:14

2 Answers 2

up vote 46 down vote accepted

It's Google Safebrowsing feature in Chrome.

That feature checking sites and tell you if that site is "Attack Site"

sinni800: @MicTech, Google has all it's search servers under the 1e100 domain. I know this is kind of late but w/e. It does not ONLY relate to google safe browsing.

share|improve this answer
... and tells Google what you're browsing. –  Moayad Mardini Nov 29 '09 at 14:12
Google Safe Browsing Policy: google.com/intl/en_us/privacy_browsing.html "When you visit a site that we think could be a phishing or malware site, your browser will send Google a hashed, partial copy of the site’s URL so that we can send more information to your browser. Google cannot determine the real URL from this information." –  Alan B Feb 8 '10 at 10:14
@MicTech, Google has all it's search servers under the 1e100 domain. I know this is kind of late but w/e. It does not ONLY relate to google safe browsing. –  sinni800 Aug 19 '11 at 9:06
@AlanB That policy makes sense only when you don't think about it. If it couldn't "determine the real URL from this information", then how the heck could it tell if it's a phishing/malware site? Besides, "partial copy of the site's URL" could mean anything, and I bet it at least contains the full domain name. Bottom line: Google can know all the sites you visit unless they really don't wanted to (which frankly doesn't seem the case). –  Camilo Martin Jan 31 '12 at 9:08
Why do the connections stay open (in System Process) long after I closed Chrome? –  Michel de Ruiter Jul 25 '12 at 21:46

Here is the truth. Google tracks you, me and everybody!

Lots of Google services use 1e100.net but that doesn't mean 1e100 is just for the services you want to have. For example Google safebrowsing feature(or I should say snitch) is being used no matter what you choose. Even if you disable any option on chrome to prevent safebrowsing, you will still have lots of connections to 1e100.net.

I have been trying to block all connections to 1e100.net but no luck! If you are using Google Chrome or any other Chrome based browser (Comodo Dragon, Yandex Browser and so on), your browser WILL send the URL you are visiting to Google. Even if you tell Chrome not to do that!

You can confirm that with these steps:

  1. Download and install Comodo Dragon(to test any Chrome based browser do that, of course Google Chrome also does that).
  2. Uncheck all checkboxes under the Privacy section in the Setting tab.
  3. Change default search engine for omnibox(you can use duckduckgo or something else).
  4. Type an URL into address bar and chrome immediately inform 1e100.net about the URL you are about to visit!

Here is the screenshot from Comodo Killswitch after I did those steps: enter image description here

Not only that, GoogleUpdate.exe will run and send some more information EVEN IF chrome is closed and GoogleUpdate service is DISABLED!

I used Comodo Firewall the block 1e100.net and guess what, Chrome still find a way to open connection and send data to 1e100.net! It even pass through firewall. I don't know how but it does!

Google started with the motto "Don't be evil" but I say, "Don't be evil, says the devil".

I recommend to use Firefox as browser (of course you will still need to disable safebrowing in Firefox) and stop using Google products. I know it is a painful experience to do it but it had to be done!

share|improve this answer

protected by Jeff Atwood Jun 7 '10 at 6:51

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.