Sucuri Blog

Website Security News

Main navigation

Gmail blacklisted by Spamhaus

Update: Gmail not blacklisted anymore.

It seems that today Spamhaus (a widely used Spam blacklist) started to blacklist the IP addresses used by gmail. We got this notification via our blacklist monitor:

< OK: Host www.gmail.com clean.
—
> WARN: http://www.spamhaus.org/query/bl?ip=74.125.227.21
> WARN: Host www.gmail.com blacklisted.

Digging further:

$ host gmail.com
gmail.com has address 74.125.227.24
gmail.com has address 74.125.227.21
gmail.com has address 74.125.227.22
gmail.com has address 74.125.227.23


Querying Spamhaus, we find:

74.125.227.21 is listed in the SBL, in the following records:
74.125.227.22 is listed in the SBL, in the following records:
74.125.227.23 is listed in the SBL, in the following records:
74.125.227.24 is listed in the SBL, in the following records:

Here is the probable reason they were blocked:

Spam Operation: Canadian Pharmacy
74.125.227.0/24 is listed on the SBL as being assigned to, being under the control of, or being otherwise connected with a known spam operation listed on the ROKSO database as: Canadian Pharmacy

Looking for more details, it seems that spammers were using docs.google.com to post some documents, which are stored in the same /24 as gmail. Spamhaus decided to blacklist the whole subnet. Details:

writely.l.google.com
Address: 74.125.227.1 – 74.125.227.15

Please stop supporting spammers.

You can start by removing the following.

————————————
http://docs.google.com/document/edit?id=1-ZumxEpeOxw2kcoZZUtuF_8pu0lQl5xkS8aV_dRN00c

http://docs.google.com/document/edit?id=10S8bRb38l1Ew8d_KVH3b2O46PPhRXYp4uv3gyNJICQs

http://docs.google.com/document/edit?id=10zmjlIiu_b-gzxBipgl8R2asyLYLLkj0OnzhEFALcW0

Details can be verified here: http://www.spamhaus.org/query/bl?ip=74.125.227.21 and here.

Check out Sucuri Security for a professional blacklist, Whois and malware monitoring solution.

  • Pingback: Tweets that mention Gmail blacklisted by Spamhaus | Sucuri -- Topsy.com()

  • Pingback: 谁给个“好”的qvod网站！你懂的 | 剧情网blog()

  • John

    another reason not to use spamhaus! What use is a spam filter if it just filters out major email providers?

    • Why don’t you ask the major email providers that use the SBL?

  • Pingback: Gmail bloqueado pelo Spamhaus | WebSegura.Net()

  • DKF

    This just goes to show, Google’s Gmaill let people abuse the TOS as everyone suspected.

  • Michael Hudson

    Do Google’s outbound MTAs really operate as “www.gmail.com?” One of my messages just came out of 74.125.82.54 which is NOT listed. This would indicate that even though spamhaus listed the class C that includes http://www.gmail.com, that would not affect any outgoing mail from Gmail users, unless some of their MTAs are operating in that class C.

  • Nice catch. Thanks!

  • These are Google docs IPs, NOT Gmail. read the SBL listing to which you link, and then please change your headline.

  • cg_

    FYI, assuming gmail's MX entries also operate as outbound MTA's, then your info is wrong as you've queried the webserver IP's.

    gmail.com mail is handled by 5 gmail-smtp-in.l.google.com.
    gmail-smtp-in.l.google.com has address 74.125.155.27
    alt1.gmail-smtp-in.l.google.com has address 74.125.157.27
    alt2.gmail-smtp-in.l.google.com has address 74.125.47.27…. etc

    The IP's are in different netblocks.

  • Pingback: Blog SegInfo – Segurança da Informação – Tecnologia – Notícias, Artigos e Novidades » Blog Archive » Gmail bloqueado no Spamhaus()

  • This article is wrong. Spamhaus did NOT blacklist Gmail. Spamhaus merely blacklisted a part of Google Docs used extensively by illegal drugs spammers. It does NOT affect Gmail in any way whatsoever. The author of this article if feeding hyperbole to idiots.

  • See: http://www.spamhaus.org/news.lasso?article=660

    "Spamhaus Blocks Gmail" – A catchy headline which certainly got the twitterati going. However, it's not true.

    Recently some IT websites, including Softpedia and sucuri.net, erroneously issued reports of Spamhaus' SBL blocking Gmail. These reports are not true. Google's Gmail service has never been listed in or affected by any Spamhaus DNSBL, nor ever would be."

  • James Senase

    Spamhaus says Securi is wrong:

    "Spamhaus Blocks Gmail? Report Was Not True." http://www.spamhaus.org/news.lasso?article=660

  • James Senase

    Spamhaus has issued a report saying that Sucuri is wrong:

    http://www.spamhaus.org/news.lasso?article=660

    “Spamhaus Blocks Gmail? Report Was Not True.”

    Quote:

    “Spamhaus Blocks Gmail” – A catchy headline which certainly got the twitterati going. However, it wasn’t true. Recently some IT websites, including Softpedia and Sucuri, erroneously issued reports of Spamhaus’ SBL blocking Gmail. These reports are not true. Google’s Gmail service has never been listed in, or affected by, any Spamhaus DNSBL, nor ever would be. Spamhaus quite simply will not list outbound mail servers of Google/Gmail or any giant freemail provider.”

Shares
Share This