0 SHARES Facebook Twitter

Update: Gmail not blacklisted anymore.

It seems that today Spamhaus (a widely used Spam blacklist) started to blacklist the IP addresses used by gmail. We got this notification via our blacklist monitor:

< OK: Host www.gmail.com clean.

—

> WARN: http://www.spamhaus.org/query/bl?ip=74.125.227.21

> WARN: Host www.gmail.com blacklisted.

Digging further:

$ host gmail.com

gmail.com has address 74.125.227.24

gmail.com has address 74.125.227.21

gmail.com has address 74.125.227.22

gmail.com has address 74.125.227.23



Querying Spamhaus, we find:

74.125.227.21 is listed in the SBL, in the following records:

74.125.227.22 is listed in the SBL, in the following records:

74.125.227.23 is listed in the SBL, in the following records:

74.125.227.24 is listed in the SBL, in the following records:

Here is the probable reason they were blocked:

Spam Operation: Canadian Pharmacy

74.125.227.0/24 is listed on the SBL as being assigned to, being under the control of, or being otherwise connected with a known spam operation listed on the ROKSO database as: Canadian Pharmacy

Looking for more details, it seems that spammers were using docs.google.com to post some documents, which are stored in the same /24 as gmail. Spamhaus decided to blacklist the whole subnet. Details:

writely.l.google.com

Address: 74.125.227.1 – 74.125.227.15 Please stop supporting spammers. You can start by removing the following. ————————————

http://docs.google.com/document/edit?id=1-ZumxEpeOxw2kcoZZUtuF_8pu0lQl5xkS8aV_dRN00c http://docs.google.com/document/edit?id=10S8bRb38l1Ew8d_KVH3b2O46PPhRXYp4uv3gyNJICQs http://docs.google.com/document/edit?id=10zmjlIiu_b-gzxBipgl8R2asyLYLLkj0OnzhEFALcW0

Details can be verified here: http://www.spamhaus.org/query/bl?ip=74.125.227.21 and here.

Check out Sucuri Security for a professional blacklist, Whois and malware monitoring solution.