I've reported it to admins via various methods (eg Spamcop), and Google was declining to accept spam reports. (ie Google's email contact address was listed as "

I've reported it to admins via various methods (eg Spamcop), and Google was declining to accept spam reports. (ie Google's email contact address was listed as "google-abuse-bounces-reports@devnull.spamcop.net") I'll double check that is still the case and try again with Google when the next one comes through. The spam I'm talking about almost always has "new autobot" or "new cryptobot" in the subject, and usually has an infected PDF attached. A simple outbound check for that would be enough to flag likely compromised accounts. That's the simple filter rule I'm using to kick it automatically into my spam folder for later review. One of the more egregious servers is mail-lf1-f48.google.com: https://www.abuseipdb.com/check/209.85.167.48 https://www.abuseipdb.com/check/209.85.167.48 But it's also coming from mail-yw1-f180.google.com, mail-yw1-f181.google.com and mail-yw1-f182.google.com, and those are just the servers I've seen in the last 24 hours. https://www.abuseipdb.com/check/209.85.128.180 https://www.abuseipdb.com/check/209.85.128.180 https://www.abuseipdb.com/check/209.85.128.181 https://www.abuseipdb.com/check/209.85.128.181 https://www.abuseipdb.com/check/209.85.128.182 https://www.abuseipdb.com/check/209.85.128.182 I am assuming it is the Google accounts that are compromised, and not Google's own mail servers. But I suppose it's possible that Google itself is pwned.