Apache logs flooded with connections - "(via ggpht.com GoogleImageProxy)"

Solution 1:

I see traffic like this too.

  • The IP addresses are always in the 66.249.64.0/19 range, which is owned by Google.
  • The User-Agents I see are always the same one you have there.
  • The URLs being requested are mostly images but sometimes not.
  • Most image URLs are requested multiple times. The top two most requested images (which, incidentally, we only include in emails our platform sends) were 2/3rds of the total requests.

I'm pretty sure it's related to the recent change they made to Gmail to automatically load images in emails but to do so through a proxy so the recipient couldn't be identified.

This blog post backs me up and includes the same User-Agent.

You could probably test this by sending yourself an HTML email to your Gmail address that included a tag like this (substituting your domain in for example.com of course):

<img src="http://example.com/this_probably_doesnt_exist.jpg">

If you see the same kind of hit from this User-Agent for that URL then I am right in my guess.