The Mysterious 1e100.net

Posted January 21, 2010 7:00 am by with 19 comments

For those of you who watch their incoming/outgoing internet connections closely, you may have noticed the domain 1e100.net pop up periodically for seemingly no reason, and in some instances you may have a persistent connection to it – even as soon as you start your computer.

What is 1e100.net? It’s Google. A WHOIS lookup for that domain reveals it’s owned by them.

Why would Google use an "weird" domain name like 1e100.net? It’s symbolic of a googol (10×10^100) which is where Google gets its name from.

Being that most people aren’t aware of this, the first reaction upon seeing this in a network management program, such as a software-based firewall, is to block it because they don’t know what it is. It further freaks people out if it shows up as a persistent connection that they can’t get rid of.

The 1e100.net domain will never show up by itself. It will always be a subdomain such as server-name.1e100.net.

Instances where you will see the 1e100.net connection

(By "see" I mean literally seeing this from a network utility that can closely monitor all network requests.)

Any web page that has embedded YouTube video

For YouTube itself (a Google property) or any other web site that has a YouTube video embedded in it, 1e100.net will show up even if the video isn’t loaded. When the Flash player first launches it makes a request to YouTube for the video thumbnail image and therefore requests 1e100.net for that data.

Firefox "safe browsing"

This feature by default is enabled and uses a Google server to check web sites you load to see if they’re in the "bad" list.

This is located from Tools / Options / Security:

image

The two checkboxes "Block reported attack sites" and "Block reported web forgeries" enable Firefox to check every single web site you load against the "bad" list Google has.

Uncheck these two boxes if you don’t want where you surf to be checked against the Google list.

If you want to see the actual configuration data for this, load the address about:config in Firefox, then search for safebrowsing, like this:

image

You don’t have to necessarily do anything here, but if you wanted to know "How much Google is in my Firefox?", there’s your answer.

Google Earth / Google Updater

Both Earth and Updater (which Earth installs by default) will make connections to 1e100.net to check for updates.

You can instruct Updater not to do that if so desired.

Other places?

As far as I’m aware, the three above instances are where you will see 1e100.net appear. Now that you’re aware what it is and its purpose, you now know it’s not spyware or malware. It’s Google. Using a weird domain because.. um.. well.. it’s a really long (but not really) story and we’ll leave it at that. :)

19 responses to The Mysterious 1e100.net

  1. Jase January 21st, 2010 at 8:44 am

    is google the new microsoft?

    first we had microsft everything, now it’s google everything.

        Reply

    • Rich Menga January 21st, 2010 at 1:31 pm

      You are definitely not the first person to say that. :)

          Reply

  2. Mel January 24th, 2010 at 11:16 am

    Excellent information….I agree with Jase. Sadly, its becoming harder to stay one step ahead of the unethical.

        Reply

  3. toddboyle January 27th, 2010 at 4:35 pm

    OK thanks for all the information.

    Where can I get a utility to BLOCK GOOGLE EVERYTHING?

    How hard is that. Sheesh. GIVE ME THE UTILITY.

        Reply

  4. doesprivacyexist January 30th, 2010 at 3:38 pm

    haha Googol. officially it’s caching or attack site verification (a “service”, but personally i think it’s to collect info on habbits… Cheaper then phoning ppl for inquiries and big money it is. Yet nobody hangs up when google is phoning you ;)… Stange. Anyhow if you’re up to it: Best learn about how to get rid of flash cookies and read about unique id’s, afterwards never visit google, youtube, etc… (yes they are the same) Don’t forget to also set search bar to something different then google too if using firefox. Maybe check out http://www.scroogle.org/cgi-bin/scraper.htm :-)

    As a final note, I want to mention, if it will not be google, it will be another. Get used to it or don’t use internet

        Reply

  5. Nick February 12th, 2010 at 6:33 pm

    You’re right that the googol has one hundred zeros but your scientific notation is off. 10*10^100 is 1e101, whereas a googol is 1*10^100 (or just 10^100 or 1e100).

        Reply

  6. confi March 13th, 2010 at 12:10 am

    ekrn.exe (nod32 antivirus) keeps connecting to 1e100…

    ekrn.exe:296 TCP 192.168.*.*:* 74.125.127.147:80 ESTABLISHED

    74.125.127.149 resolves to
    “pz-in-f149.1e100.net”
    Top Level Domain: “1e100.net”
    Country IP Address: UNITED STATES

        Reply

    • Jim Cooper (of course) November 26th, 2013 at 1:27 am

      I wonder who has the job of dreaming up all the sub-domain and sub-sub-domain names to use with 1e100.net … : ))

          Reply

  7. Oliver Slay April 30th, 2010 at 3:19 pm

    GoogleMail, Blogger, GTalk … all appear to open connections to 1e100 …

        Reply

  8. N0ah June 18th, 2010 at 5:11 am

    i'm also getting this for port 993 (i think it's an imap thing or something as i'm usinng google for email hosting and stuff)

        Reply

  9. mxm June 18th, 2010 at 11:16 am

    You can see the 1e100.net also if you 'ping http://www.google.com';
    (and of course by using nslookup/dig but that's geeky stuff ;-)

        Reply

    • TechnoShaman December 16th, 2012 at 3:44 pm

      PING showed me nothing of the sort. I think you mean to say, “Do a TRACEROUTE”, as in
      tracert http://www.google.com
      (leave off the http:// stuff, it is not the proper syntax for this)
      which for me leads to a series of anonymous servers along the path… rather odd.
      For those unfamiliar with this “geeky stuff”, these are DOS-like commands you use in a Command Window in Windows: CMD.EXE followed by TRACERT and the NAME or ADDRESS you wish to inquire about, which does not have to be an http type name or address:
      tracert google.com
      works just fine (but checks a slightly different address).

      Regards, etc.

          Reply

  10. Biswajit August 9th, 2010 at 4:07 pm

    Well why actually google is using 1e100.net for is quite unknown, but i checked out the above link to find out, what is the link between google and 1e100

        Reply

    • Jim Cooper November 26th, 2013 at 1:30 am

      A ‘google’ is the name for the number that is one with 100 zeros… similar to Tera .. and Mega … we’re just not used to dealing with numbers quite that big … YET ..

          Reply

  11. d0ug October 4th, 2010 at 1:02 am

    you will see that domain when you start firefox… you know.. the default google search page that loads when you first start google?

        Reply

  12. Agua Loca SL October 26th, 2010 at 12:28 am

    found 12 names for the MX servers for ESTAFADORES agualoca.es: TIMO gy-in-f27.1e100.net, alt1.aspmx.l.google.com, bw-in-f27.1e100.net, qy-in-f27.1e100.net, aspmx2.googlemail.com, iw-in-f27.1e100.net, aspmx.l.google.com, pv-in-f27.1e100.net, aspmx3.googlemail.com, aspmx4.googlemail.com, ww-in-f27.1e100.net, and alt2.aspmx.l.google.com. (A single machine may go by more than one hostname. All of them are shown.)

        Reply

  13. Michael November 12th, 2010 at 11:04 pm

    > …it’s not spyware or malware. It’s Google…

    Well, who says that Google isn’t spying on you anyway. Just because it’s Google doesn’t mean it’s can’t or won’t be used against you.

        Reply

    • Randy April 11th, 2014 at 8:41 am

      They are, Google tracks everything and every site.

          Reply

  14. Tiago Paolini January 13th, 2013 at 1:48 pm

    Just in case someone is interested, here is the official satement from Google about this domain:
    http://support.google.com/bin/answer.py?hl=en&answer=174717

        Reply

Leave a Reply