Less than 60 seconds after sending an email w/ Gmail that contained a pasted https link to a .zip file, that file was accessed by two non-Google servers. Neither server belongs to the email recipient.

One of those servers is an Amazon Web Services (AWS) server, so that might be Google. But the other is not, and strangely, its referral URL is a google.com search result link in the form http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web...

Based on the file size, it appears the entire file was not downloaded (it's quite large). But I'm confused as to what's going on here. Is this something Google is doing for the purposes of previewing the link? Or is someone else getting access to this email? It was so quick, that I do think something automated is likely (as opposed to someone sitting around reading my email).

  • 5
    It could be some anti virus detection by gmail.
    – yeah_well
    Apr 29, 2019 at 6:37
  • 1
    You didn't say where the other IP was, what network it belongs to, if you tried any reverse DNS services, etc. Whether it's really suspicious or not depends on that info.
    – reed
    Apr 29, 2019 at 10:43

1 Answer 1


There are many, many participants between your client machine, Gmail, email infrastructure, the recipient's email provider, and the recipient's email client. And that's just the email stack of technologies. Any one of those parties, or a service used by one of those parties, may have checked the link for malware, content, or reputation or some other purpose.

Is someone else getting access to the email? Most definitely "yes". Each one of those parties touches it and, quite obviously, can read the content. Email is not a secure method of communication. That's why email content encryption is important, though tricky to implement.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .