• Skip to primary navigation
  • Skip to content
  • Skip to primary sidebar
  • Skip to footer

Sucuri Blog

Website Security News

  • Products
    • Website Security Platform
    • Website Firewall (WAF)
    • Enterprise Website Security
    • Multisite Solutions
  • Features
    • Detection
    • Protection
    • Performance
    • Response
    • Backups
  • Partners
    • Agency Solutions
    • Partners
    • Referral Program
    • Ecommerce
  • Resources
    • Guides
    • Webinars
    • Infographics
    • SiteCheck
    • Reports
    • Email Courses
  • Immediate Help
  • Login

Gmail blacklisted by Spamhaus

August 19, 2010David Dede

0
SHARES
FacebookTwitterSubscribe

Update: Gmail not blacklisted anymore.

It seems that today Spamhaus (a widely used Spam blacklist) started to blacklist the IP addresses used by gmail. We got this notification via our blacklist monitor:

< OK: Host www.gmail.com clean.
—
> WARN: http://www.spamhaus.org/query/bl?ip=74.125.227.21
> WARN: Host www.gmail.com blacklisted.

Digging further:

$ host gmail.com
gmail.com has address 74.125.227.24
gmail.com has address 74.125.227.21
gmail.com has address 74.125.227.22
gmail.com has address 74.125.227.23


Querying Spamhaus, we find:

74.125.227.21 is listed in the SBL, in the following records:
74.125.227.22 is listed in the SBL, in the following records:
74.125.227.23 is listed in the SBL, in the following records:
74.125.227.24 is listed in the SBL, in the following records:

Here is the probable reason they were blocked:

Spam Operation: Canadian Pharmacy
74.125.227.0/24 is listed on the SBL as being assigned to, being under the control of, or being otherwise connected with a known spam operation listed on the ROKSO database as: Canadian Pharmacy

Looking for more details, it seems that spammers were using docs.google.com to post some documents, which are stored in the same /24 as gmail. Spamhaus decided to blacklist the whole subnet. Details:

writely.l.google.com
Address: 74.125.227.1 – 74.125.227.15

Please stop supporting spammers.

You can start by removing the following.

————————————
http://docs.google.com/document/edit?id=1-ZumxEpeOxw2kcoZZUtuF_8pu0lQl5xkS8aV_dRN00c

http://docs.google.com/document/edit?id=10S8bRb38l1Ew8d_KVH3b2O46PPhRXYp4uv3gyNJICQs

http://docs.google.com/document/edit?id=10zmjlIiu_b-gzxBipgl8R2asyLYLLkj0OnzhEFALcW0

Details can be verified here: http://www.spamhaus.org/query/bl?ip=74.125.227.21 and here.


Check out Sucuri Security for a professional blacklist, Whois and malware monitoring solution.

0
SHARES
FacebookTwitterSubscribe

Categories: UncategorizedTags: Google, SEO Spam, Website Blacklist

About David Dede

David is a Security Researcher at Sucuri. He spends most of his time dissecting vulnerabilities and security issues. You won't find him on Twitter because he is paranoid about privacy.

Reader Interactions

Comments

  1. John

    August 19, 2010

    another reason not to use spamhaus! What use is a spam filter if it just filters out major email providers?

    • Neil Schwartzman

      August 19, 2010

      Why don’t you ask the major email providers that use the SBL?

  2. DKF

    August 19, 2010

    This just goes to show, Google’s Gmaill let people abuse the TOS as everyone suspected.

  3. Michael Hudson

    August 19, 2010

    Do Google’s outbound MTAs really operate as “www.gmail.com?” One of my messages just came out of 74.125.82.54 which is NOT listed. This would indicate that even though spamhaus listed the class C that includes http://www.gmail.com, that would not affect any outgoing mail from Gmail users, unless some of their MTAs are operating in that class C.

  4. Andrew Warner

    August 19, 2010

    Nice catch. Thanks!

  5. Neil Schwartzman

    August 19, 2010

    These are Google docs IPs, NOT Gmail. read the SBL listing to which you link, and then please change your headline.

    • dremeda

      August 19, 2010

      Hi Neil, please read the full article before posting, thanks!
      My recent post Gmail blacklisted by Spamhaus

  6. cg_

    August 19, 2010

    FYI, assuming gmail's MX entries also operate as outbound MTA's, then your info is wrong as you've queried the webserver IP's.

    gmail.com mail is handled by 5 gmail-smtp-in.l.google.com.
    gmail-smtp-in.l.google.com has address 74.125.155.27
    alt1.gmail-smtp-in.l.google.com has address 74.125.157.27
    alt2.gmail-smtp-in.l.google.com has address 74.125.47.27…. etc

    The IP's are in different netblocks.

  7. @jamessenase

    August 20, 2010

    This article is wrong. Spamhaus did NOT blacklist Gmail. Spamhaus merely blacklisted a part of Google Docs used extensively by illegal drugs spammers. It does NOT affect Gmail in any way whatsoever. The author of this article if feeding hyperbole to idiots.

  8. @jamessenase

    August 20, 2010

    See: http://www.spamhaus.org/news.lasso?article=660

    "Spamhaus Blocks Gmail" – A catchy headline which certainly got the twitterati going. However, it's not true.

    Recently some IT websites, including Softpedia and sucuri.net, erroneously issued reports of Spamhaus' SBL blocking Gmail. These reports are not true. Google's Gmail service has never been listed in or affected by any Spamhaus DNSBL, nor ever would be."

  9. James Senase

    August 20, 2010

    Spamhaus says Securi is wrong:

    "Spamhaus Blocks Gmail? Report Was Not True." http://www.spamhaus.org/news.lasso?article=660

  10. James Senase

    August 20, 2010

    Spamhaus has issued a report saying that Sucuri is wrong:

    http://www.spamhaus.org/news.lasso?article=660

    “Spamhaus Blocks Gmail? Report Was Not True.”

    Quote:

    “Spamhaus Blocks Gmail” – A catchy headline which certainly got the twitterati going. However, it wasn’t true. Recently some IT websites, including Softpedia and Sucuri, erroneously issued reports of Spamhaus’ SBL blocking Gmail. These reports are not true. Google’s Gmail service has never been listed in, or affected by, any Spamhaus DNSBL, nor ever would be. Spamhaus quite simply will not list outbound mail servers of Google/Gmail or any giant freemail provider.”

Primary Sidebar

Socialize With Sucuri

We're actively engaged across multiple platforms. Follow us and let's connect!

  • Facebook
  • Twitter
  • LinkedIn
  • YouTube
  • Instagram
  • RSS Feed

Join Over 20,000 Subscribers!

Footer

Products

  • Website Firewall
  • Website AntiVirus
  • Website Backups
  • WordPress Security
  • Enterprise Services

Solutions

  • DDos Protection
  • Malware Detection
  • Malware Removal
  • Malware Prevention
  • Blacklist Removal

Support

  • Blog
  • Knowledge Base
  • SiteCheck
  • Research Labs
  • FAQ

Company

  • About
  • Media
  • Events
  • Employment
  • Contact
  • Testimonials
  • Facebook
  • Twitter
  • LinkedIn
  • Instagram

Customer Login

Sucuri Home

  • Terms of Use
  • Privacy Policy
  • Frequently Asked Questions

© 2021 Sucuri Inc. All rights reserved

Sucuri Cookie Policy
See our policy>>

Our website uses cookies, which help us to improve our site and enables us to deliver the best possible service and customer experience.