When I click that link at the bottom of my gmail screen where it says "Last account activity: 0 minutes ago at IP Details". I click the link and sure enough, it shows accesses from my own IP (IMAP and browser), but it also shows IMAP access from this IP, which appears to belong to an Amazon EC2 instance. I can't think of any reason why an EC2 instance would be accessing my email. Should I be concerned?

Update: I changed my password an hour ago and logged back in from my browser and my iPhone, and then went out to dinner. Now it's showing accesses from my home IP (browser and IMAP), and IMAP accesses from (Amazon EC2), ("Service Provider Corporation"), and (AT&T). So either AT&T or Apple is using, or some other app on my iPhone got my gmail password and is sharing it with people they shouldn't.

  • Are you using Backupify? – Sathyajith Bhat May 14 '11 at 13:05
  • Hmm, a look at my activity indicates an access from and I don't have an iPhone, neither is my carrier AT&T – Sathyajith Bhat May 14 '11 at 13:07

So many services now depend on the EC2 that it can be difficult to pinpoint which one is doing what but it's almost always legitimate when you see this sort of activity from Amazon.

I would normally say this was absolutely nothing to worry about but given the recent (and spectacular) crash of the Amazon cloud, you might consider a password change just to be on the safe side.

| improve this answer | |
  • 2
    Try and think if there's ANY service you've given permission to access your email - there's a good chance that just about anything could be using Amazon EC2 to delegate its email pulling tasks. Maybe some kind of mobile client that works with an outside server to store data? – jcrawfordor May 13 '11 at 23:04
  • 1
    One of the reasons I worry is that EC2 is used by a lot of legitimate businesses, but it's also used by spammers and others who like to cover their tracks and know they can easily switch to a new IP if their current one starts getting blocked. – Paul Tomblin May 13 '11 at 23:31

Figured it out - it was "Xobni for Chrome".

I had disabled the plugin, but somehow it managed to transmit my changed password back to the mothership, in spite of being disabled. I removed the plugin entirely and told them to purge my account.

| improve this answer | |

I'm experiencing the same.

I've logged an Suspected Abuse ticket with Amazon as I don't know the identity of those servers, but 24 hours later I haven't heard anything back other than an acknowledgement that someone was using that server at the time.

Google Enterprise Support have responded very helpfully and have investigated the issue: however they were unable to provide any more information about the identity of the access.

Since then I've changed my password, added 2-factor authentication (doesn't affect IMAP access unfortunately), revoked all application-specific passwords and pruned back all services which have access, and still the IMAP logins occurred. That stumped me...

I then found that I had two Google Apps Marketplace services setup at domain level (Domain control panel for Google Apps for Business) with Mail API access - CapsuleCRM and GQueues.

These have now been disabled and I'm waiting another 24 hours to see if that was it.

**Pointer to Google: to avoid us all getting the scares put up us, how about indicating which authorised application is accessing the account in the Activity Log page?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.