Why is Google approaching my VPS machine?

I'm trying to track network activities on my machine running CentOS 7.

According to iptables logs, it seems that Google (74.125.133.108) is approaching my VPS many times.

I can see that source-port is always 993.

What is the reason for that?

16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=60 TOS=0x00 PREC=0xA0 TTL=107 ID=4587 PROTO=TCP SPT=993 DPT=47920 WINDOW=62392 RES=0x00 ACK SYN URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=4666 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=2767 TOS=0x00 PREC=0xA0 TTL=107 ID=4668 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=331 TOS=0x00 PREC=0xA0 TTL=107 ID=4704 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=150 TOS=0x00 PREC=0xA0 TTL=107 ID=4705 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=299 TOS=0x00 PREC=0xA0 TTL=107 ID=4733 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=4771 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=354 TOS=0x00 PREC=0xA0 TTL=107 ID=5026 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5094 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:11 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=128 TOS=0x00 PREC=0xA0 TTL=107 ID=5116 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5187 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=124 TOS=0x00 PREC=0xA0 TTL=107 ID=5189 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5195 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=339 TOS=0x00 PREC=0xA0 TTL=107 ID=5213 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=119 TOS=0x00 PREC=0xA0 TTL=107 ID=5214 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK PSH URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5229 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK URGP=0
16:22:12 kernel: ipt IN=eth0 OUT= MAC=... SRC=74.125.133.108 DST=... LEN=52 TOS=0x00 PREC=0xA0 TTL=107 ID=5257 PROTO=TCP SPT=993 DPT=47920 WINDOW=248 RES=0x00 ACK FIN URGP=0

Solution 1:

Notice the ACK SYN on the first packet in your dump? Those flags indicate the second stage of the three-way TCP handshake.

Since this packet is coming from Google, it indicates that Google is not "approaching your VPS"; your VPS is connecting to Google on port 993, and Google is sending back an acknowledgement.

To investigate this further, you can use the iptables command to view details (including process IDs) of connections that are currently active. You can also use the kernel audit subsystem to log outgoing connections as they happen.

Solution 2:

Port 993 is for encrypted IMAP traffic.

Gmail has a feature where it can check external IMAP servers and bring those emails into your inbox.

As such, I suspect your IP address was previously that of someone's email server, and they configured Gmail to check that server for their emails. (Alternatively, but less likely, that "someone" is you, and you forgot you did this.)