7

Gmail tells me that it was recently accessed by IP address 242.162.62.141, and that it blocked the suspicious access, and I should change my password immediately. But 242.162.62.141 is a reserved IP address according to IANA. It's not registered with RIPE, ARIN, AfriNIC, LACNIC or APNIC. So... How can this be? How could someone even use such an IP address in the first place, and try to access my Gmail account of all things?

All registries report the IP address as "reserved", and ARIN shows it as being owned by IANA. This is the description I found about the 240.0.0.0 - 255.255.255.255 range:

This block, formerly known as the Class E address space, is reserved for future use. The one exception to this is the "limited broadcast" destination address 255.255.255.255. As documented in the Standards RFC 919 and RFC 922, packets with this destination address are not forwarded at the IP layer. This block was reserved by the IETF in the Standard document, RFC 1112 and is further documented in the Best Current Practice document RFC 5735.

Improve this question

2 Answers 2

Reset to default
12

I'm the Gmail Community Manager. I spoke with our team about what you described.

What you are seeing is a bug in our system related to the use of IPv6. Very specific types of logins to do with mobile phone syncing that come in over IPv6 are not currently treated correctly. We're in the process of fixing this issue and I apologize for the inconvenience.

Improve this answer
1
  • four years later, and I've just heard another report of this exact bug...
    – Alnitak
    Commented Jul 11, 2016 at 17:48
4

Someone seems to have faked the IP address and tried to access your account. That can be the only explanation as any traffic from that IP address is kind of impossible.

Good that you changed password, also turn on two-step authentication if you haven't already.

Edit: Found this question at Gmail support forum. They said the same thing.

Improve this answer
7
  • But what purpose would it serve to fake the IP? If the attacker uses an impossible IP, how can he find out if the attack succeeded or not, if he can't receive anything to this IP?
    – rid
    Commented May 11, 2012 at 13:13
  • That, the attacker would know best. :) This is only a possible guess.
    – Bibhas
    Commented May 11, 2012 at 13:22
  • IP's are generally used to determine if traffic is spammy or bot-driven. by spoofing an IP the attacker can keep their true IP cleaner.
    – Rebecca Dessonville
    Commented May 11, 2012 at 14:23
  • @Dez, that makes sense, but what I don't understand is how do they get the result of their work if they spoof their IP? Wouldn't the acknowledgment that the guessed password is correct go to the impossible IP and never reach the attacker? How do they know they successfully logged in?
    – rid
    Commented May 11, 2012 at 20:25
  • @Radu I'm not actually sure. inner-workings of network traffic isn't really my forte.
    – Rebecca Dessonville
    Commented May 11, 2012 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.