Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

When I click that link at the bottom of my gmail screen where it says "Last account activity: 0 minutes ago at IP 50.19.49.49 Details". I click the link and sure enough, it shows accesses from my own IP (IMAP and browser), but it also shows IMAP access from this IP 50.19.49.49, which appears to belong to an Amazon EC2 instance. I can't think of any reason why an EC2 instance would be accessing my email. Should I be concerned?

Update: I changed my password an hour ago and logged back in from my browser and my iPhone, and then went out to dinner. Now it's showing accesses from my home IP (browser and IMAP), and IMAP accesses from 50.19.49.49 (Amazon EC2), 198.227.195.87 ("Service Provider Corporation"), and 166.137.137.85 (AT&T). So either AT&T or Apple is using 50.19.49.49, or some other app on my iPhone got my gmail password and is sharing it with people they shouldn't.

share|improve this question

migrated from superuser.com May 14 '11 at 13:05

This question came from our site for computer enthusiasts and power users.

    
Are you using Backupify? –  Sathya May 14 '11 at 13:05
    
Hmm, a look at my activity indicates an access from 50.19.10.233 and I don't have an iPhone, neither is my carrier AT&T –  Sathya May 14 '11 at 13:07
add comment

3 Answers

So many services now depend on the EC2 that it can be difficult to pinpoint which one is doing what but it's almost always legitimate when you see this sort of activity from Amazon.

I would normally say this was absolutely nothing to worry about but given the recent (and spectacular) crash of the Amazon cloud, you might consider a password change just to be on the safe side.

share|improve this answer
2  
Try and think if there's ANY service you've given permission to access your email - there's a good chance that just about anything could be using Amazon EC2 to delegate its email pulling tasks. Maybe some kind of mobile client that works with an outside server to store data? –  jcrawfordor May 13 '11 at 23:04
1  
One of the reasons I worry is that EC2 is used by a lot of legitimate businesses, but it's also used by spammers and others who like to cover their tracks and know they can easily switch to a new IP if their current one starts getting blocked. –  Paul Tomblin May 13 '11 at 23:31
add comment
up vote 3 down vote accepted

Figured it out - it was "Xobni for Chrome".

I had disabled the plugin, but somehow it managed to transmit my changed password back to the mothership, in spite of being disabled. I removed the plugin entirely and told them to purge my account.

share|improve this answer
3  
You just can revoke Xobni authorization here accounts.google.com/b/0/IssuedAuthSubTokens –  al.dexter Jan 19 '12 at 12:40
add comment

I'm experiencing the same.

I've logged an Suspected Abuse ticet with Amazon as I don't know the identity of those servers, but 24 hours later I haven't heard anything back other than an acknowledgement that someone was using that server at the time.

Google Enterprise Support have responded very helpfully and have investigated the issue: however they were unable to provide any more information about the identity of the access.

Since then I've changed my password, added 2-factor authentication (doesn't affect IMAP access unfortunately), revoked all application-specific passwords and pruned back all services which have access, and still the IMAP logins occurred. That stumped me...

I then found that I had two Google Apps Marketplace services setup at domain level (Domain control panel for Google Apps for Business) with Mail API access - CapsuleCRM and GQueues.

These have now been disabled and I'm waiting another 24 hours to see if that was it.

**Pointer to Google: to avoid us all getting the scares put up us, how about indicating which authorised application is accessing the account in the Activity Log page?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.