5 ms·

The spam is quite likely coming via Google itself. Google's mail servers have been compromised for several weeks now. It's commonly being used for infected cry

The spam is quite likely coming via Google itself. Google's mail servers have been compromised for several weeks now. It's commonly being used for infected crypto spam (all those "new traderbot" emails with the attached infected PDF, for example). I'm not yet sure if these are just compromised GMail accounts, or if the mail servers themselves have been compromised. There seem to be some reports on AbuseIPDB of intrusion attempts coming directly from Google's mail servers. I've tried reporting it to Google (eg via SpamCop), and Google declines to receive reports. I have been reporting it through AbuseIPDB as well. Here is one Google mail server that has had over 300 abuse reports: https://www.abuseipdb.com/check/209.85.167.48 https://www.abuseipdb.com/check/209.85.167.48 There are many more, and I linked to a few more when I posted about it here on HN over a month ago: https://news.ycombinator.com/item?id=32434810 https://news.ycombinator.com/item?id=32434810

tallanvor 4y ago
Unfortunately every major provider has this happen. Google and Microsoft especially since they have their productivity platforms that send mail through the same infrastructure as their free email services. They also have to deal with more problems through compromised education accounts - students aren't that great at protecting their school credentials, and some businesses aren't much better.
- sodality2 4y ago
  I don't think that it's common for a Google mail server to be brute forcing SMTP logins for other servers, and also sending high amounts of spam. It looks like the server has been compromised, or else why would Google be making SMTP login requests?
  - declon 4y ago
    You can give Gmail your SMTP login details and tell it to send your mail via another server.
0___0 4y ago
weeks? more like months. Yep, can't report them via SpamCop. I always report them via https://support.google.com/mail/contact/abuse?hl=en https://support.google.com/mail/contact/abuse?hl=en Not sure why they can't fix their crap.
- SyneRyder 4y ago
  Thank you! I somehow never came across that URL before. It's worth a try, though I'm not very optimistic it will help! I'd genuinely be interested to know from someone working at Google why Google can't / won't solve this, even for the narrow clearly-defined cases I see.
  - stazz1 4y ago
    Occasionally I e-mail code@google.com I think someone somewhere actually reads it
  - dylan604 4y ago
    A) How much money does it cost Google to fix a problem? B) How much money does it cost Google to not fix a problem? If A > B then, duh!
    - alexvoda 4y ago
      Just set a filter to automatically forward spam to sundar (at) google (dot) com
      - dylan604 4y ago
        You assume of course someone not related to Googs other than having a gmail account is NOT the one with that email address.
    - hulitu 4y ago
      How many Google "engineers" do you need to change a lightbulb ?
nwellnhof 4y ago
Yes, I've noticed this crypto/traderbot spam campaign a few weeks ago, and it definitely comes from Gmail itself. It's nice to see that it also affects other Gmail users. Maybe Google will finally get their act together and stop all the Gmail spam. Right now, I get about 100 spam emails from Gmail each month, making it the biggest source of spam for me. If it wasn't that half of the world uses their services, I'd have blocked Google's mail servers a long time ago.
jeffbee 4y ago
Those outbound VIPs aren’t attached to “a mail server”. If some outside party has gained the level of access you are suggesting, to just freely use these VIPs, then they have compromised the entire Google.
mc32 4y ago
Whatever happened to the Postini acquisition, did they get diluted over the years?
chrisjc 4y ago
> compromised GMail accounts If it is coming from compromised Gmail accounts, I wonder if these same accounts are also being used to post the handful of deep-fake Elon Musk crypto YouTube Shorts that inundate the Shorts feeds. There's hundreds, maybe thousands of these videos being posted making Shorts practically unusable. And no amount of reporting or downvoting seems to affect their algorithm.

tallanvor 4y ago

Unfortunately every major provider has this happen. Google and Microsoft especially since they have their productivity platforms that send mail through the same infrastructure as their free email services. They also have to deal with more problems through compromised education accounts - students aren't that great at protecting their school credentials, and some businesses aren't much better.

sodality2 4y ago
I don't think that it's common for a Google mail server to be brute forcing SMTP logins for other servers, and also sending high amounts of spam. It looks like the server has been compromised, or else why would Google be making SMTP login requests?
- declon 4y ago
  You can give Gmail your SMTP login details and tell it to send your mail via another server.

0___0 4y ago

weeks? more like months. Yep, can't report them via SpamCop. I always report them via https://support.google.com/mail/contact/abuse?hl=en https://support.google.com/mail/contact/abuse?hl=en Not sure why they can't fix their crap.

SyneRyder 4y ago
Thank you! I somehow never came across that URL before. It's worth a try, though I'm not very optimistic it will help! I'd genuinely be interested to know from someone working at Google why Google can't / won't solve this, even for the narrow clearly-defined cases I see.
- stazz1 4y ago
  Occasionally I e-mail code@google.com I think someone somewhere actually reads it
- dylan604 4y ago
  A) How much money does it cost Google to fix a problem? B) How much money does it cost Google to not fix a problem? If A > B then, duh!
  - alexvoda 4y ago
    Just set a filter to automatically forward spam to sundar (at) google (dot) com
    - dylan604 4y ago
      You assume of course someone not related to Googs other than having a gmail account is NOT the one with that email address.
  - hulitu 4y ago
    How many Google "engineers" do you need to change a lightbulb ?

nwellnhof 4y ago

Yes, I've noticed this crypto/traderbot spam campaign a few weeks ago, and it definitely comes from Gmail itself. It's nice to see that it also affects other Gmail users. Maybe Google will finally get their act together and stop all the Gmail spam. Right now, I get about 100 spam emails from Gmail each month, making it the biggest source of spam for me. If it wasn't that half of the world uses their services, I'd have blocked Google's mail servers a long time ago.

jeffbee 4y ago

Those outbound VIPs aren’t attached to “a mail server”. If some outside party has gained the level of access you are suggesting, to just freely use these VIPs, then they have compromised the entire Google.

mc32 4y ago

Whatever happened to the Postini acquisition, did they get diluted over the years?

chrisjc 4y ago

> compromised GMail accounts If it is coming from compromised Gmail accounts, I wonder if these same accounts are also being used to post the handful of deep-fake Elon Musk crypto YouTube Shorts that inundate the Shorts feeds. There's hundreds, maybe thousands of these videos being posted making Shorts practically unusable. And no amount of reporting or downvoting seems to affect their algorithm.