Ask HN: Odd Traffic from Googlebot

3 sugarpimpdorsey 0 7/30/2025, 6:30:21 AM

I've been analyzing server logs and noticed some oddities with traffic originating from Google. I did verify the ASN and reverse DNS. Everything checks out.

Every Googlebot request has a forged or bogus HTTP Host: header, usually populated with some random third-world site I've never heard of. The Referer is likewise forged, and usually points to a page on the bogus Host: header domain.

Is this some coding bug in Googlebot or are they checking for some SSRF exploit I don't quite understand?

Slow (michaelnotebook.com)

QUIC for the kernel (lwn.net)

Gemini Embedding: Powering RAG and context engineering (developers.googleblog.com)

Show HN: Mcp-use – Connect any LLM to any MCP (github.com)

Radiant Nuclear – Portable Power (radiantnuclear.com)

Secure boot certificate rollover is real but probably won't hurt you (mjg59.dreamwidth.org)

How was the Universal Pictures 1936 opening logo created? (movies.stackexchange.com)

MacBook Pro Insomnia (manuel.bernhardt.io)

Ubiquiti launches UniFi OS Server for self-hosting (lazyadmin.nl)

Show HN: Sourcebot – Self-hosted Perplexity for your codebase (github.com)

Releasing open weights for FLUX.1 Krea (krea.ai)

Kaizen (YC X25) is hiring engineers to build browser agents that work (kaizenautomation.com)

Launch HN: Gecko Security (YC F24) – AI That Finds Vulnerabilities in Code

Introduction to Computer Music (cmtext.com)

We revamped our docs for AI-driven development (docs.freestyle.sh)

Show HN: AgentMail – Email infra for AI agents (chat.agentmail.to)

I tried Servo (spacebar.news)

Face it: you're a crazy person (experimental-history.com)

Astronomical Telescope "Hadley" – an easy assembly, high performance Newtonian (printables.com)

Ferrari Status (collabfund.com)

AI is a floor raiser, not a ceiling raiser (elroy.bot)

Build a confetti bot with a Raspberry Pi (2023) (docs.viam.com)

Zig Profiling on Apple Silicon (blog.bugsiki.dev)

What is gVisor? (blog.yelinaung.com)

Go Assembly Mutation Testing (words.filippo.io)

Dark patterns (nsw.gov.au)

Ursa: A leaderless, object storage–based alternative to Kafka (streamnative.io)

How Long Before Superintelligence? (1997) (nickbostrom.com)

Show HN: SafeRate – AI chat-native mortgage lender (saferate.com)

Advanced Rust macros with derive-deftly (diziet.pages.torproject.net)

150 years of Hans Christian Andersen (newstatesman.com)

U.S. senators introduce new pirate site blocking bill, "Block BEARD" (torrentfreak.com)

So you're a manager now (scottkosman.com)

Following Up on the Python JIT (lwn.net)

Engineering Buy-In (venki.dev)

Orion Browser (kagi.com)

GEPA: Reflective prompt evolution can outperform reinforcement learning (arxiviq.substack.com)

Show HN: The easiest accessibility (a11y) checker for VSCode (github.com)

Magentic-UI: Towards Human-in-the-Loop Agentic Systems (arxiv.org)

Sumo – Simulation of Urban Mobility (eclipse.dev)

How to Scan Force Pushed Commits for Secrets (trufflesecurity.com)

Show HN: Astro dev blog template with interactive colorschemes (multiterm.stelclementine.com)

The Math Is Haunted (overreacted.io)

The Future of Programming (2013) (worrydream.com)

OpenAI's ChatGPT Agent casually clicks through "I am not a robot" verification (arstechnica.com)

KDE Linux (kde.org)

Profiling without Source code – how I diagnosed Trackmania stuttering (larstofus.com)

Many countries that said no to ChatControl in 2024 are now undecided (digitalcourage.social)

How to trigger a command on Linux when power switches from AC to battery (dataswamp.org)

Go’s race detector has a mutex blind spot (doublefree.dev)

Ask HN: Odd Traffic from Googlebot

Comments (0)