I have had a red warning box on top of the page when I access GMail. It says that there have been three attacks from China:

IP Address:
Location: Xuancheng, Anhui, China

and two others.

Is this common?

Could this be done from anywhere around the world or just from China? I mean, if the Chinese firewall will block hackers e.g. from France, US or Israel to access some computer in Xuancheng, Anhui, China and act as a Chinese attack or the wall is preventing from this.

It seems IMO that attacks from China is the most common place of attack. Is this just a coincidence or purposefully doing because it is not easy to ask Chinese government for permission of logs when using China servers for attacks on EU or US targets.

This is in an email from Google:


Someone recently tried to use an application to sign in to your Google Account, [email protected]. We prevented the sign-in attempt in case this was a hijacker trying to access your account. Please review the details of the sign-in attempt:

Tuesday, October 23, 2012 10:06:26 AM GMT
IP Address: Location: Xuancheng, Anhui, China

If you do not recognize this sign-in attempt, someone else might be trying to access your account. You should sign in to your account and reset your password immediately. Find out how at http://support.google.com/accounts?p=reset_pw

If this was you, and you want to give this application access to your account, complete the troubleshooting steps listed at http://support.google.com/mail?p=client_login

The Google Accounts Team

  • 3
    The Chinese Firewall is not really a firewall, the way it is usually meant. It is actually more of a massive outbound content filter.
    – AviD
    Oct 23, 2012 at 12:13
  • 1
    I'm not sure what you mean by the fourth paragraph. Could you clarify what security policy you expect the Chinese Firewall to implement? Are you asking whether the attribution of an attack to an IP is high confidence, or are you asking something about the Chinese firewall?
    – MCW
    Oct 23, 2012 at 12:43
  • 1
    I should point out, in many cases I have discovered that Google claims access from a particular country, only to find out said access was not possible. So there is no guarantee that somebody actually in China accessed your account.
    – Ramhound
    Oct 23, 2012 at 16:31
  • 1
    Well, i had the same situation and It really can be from China, but hacker could also use IP changer. Anywhere, you better change your password and save your mail-box.
    – Daruntim
    Oct 24, 2012 at 12:47

3 Answers 3


Well, there are actually a range of questions in there but the big one is your second last paragraph.

The Internet allows us to be attacked by individuals anywhere in the world.

Access controls help to prevent a lot of attacks, but all of them can be bypassed given enough effort, and this includes the Great Firewall of China along with every other device or application. The only way to be sure is to disconnect your computer entirely, then lock it in a room, and hide the key. And post guards. And watch the guards etc

So this is why security is really a business decision - you can get as much security as you pay for, but if you are a desirable target you need to buy much more security.

Various surveys by companies such as Kaspersky show the apparent sources of attacks, and China is high up there, but so are the US, Eastern Europe, Israel, the Philippines, and a wide range of countries. While some of this data is no doubt correct, some of it is likely to be spoofed by smart attackers routing through machines in other countries.

And the whole issue of getting logs from other countries - it is a nightmare. Many ISP's just won't divulge this info. Some countries block requests entirely.

  • 1
    You forgot the underground concrete bunker with a Faraday cage lining the walls. And is that disconnect also from power, or do I need a generator in that room with it?
    – ewanm89
    Oct 23, 2012 at 12:29

I think there is a confusion on the "Great Firewall of China". Isn't the main purpose of this so called firewall to censor some websites ?

At least i wouldn't say the firewall is preventing any chinese hacker to hack all around the world.

Anyway, as RoryAlsop pointed, no firewall could really prevent someone from china to scan/hack someone anywhere in the world. Modern hackers oftenly use hosts all around the world as proxy to hide the real origin of their actions.

Then in that case, could hackers use proxies in china to make people less likely to trace them back ? It could be. It's sure possible to do so.

I would say there is a lot of malicious traffic coming from china more because of it's very important population rather than the protective country's policy on hacking.

  • 2
    What do you mean by "very important population"?
    – user13779
    Oct 23, 2012 at 12:28
  • This answer would be stronger if (a) the question were clear and (b) it included references/citations.
    – MCW
    Oct 23, 2012 at 12:48
  • @MarkC.Wallace by references/citations you mean screenshot of my Google Mail Account?
    – user13779
    Oct 23, 2012 at 12:58
  • No, but a reference to the firewall would help; the discussion indicates that there is some confusion over the goals/purposes/security policy of that firewall, and I think a citation would transform the discussion away from assertions and into research. The answer could also include a reference out to how hackers use proxies - again, at the moment that is an assertion, but it would be stronger with evidence. Plus "important" vice "large" . I'm not saying this is bad I'm saying that the valuable answers have cites.
    – MCW
    Oct 23, 2012 at 14:56
  • @MarkC.Wallace - user15324 can't provide more details because they have no idea what they are talking about. Besides its pretty clear that the Great Firewall of China is an advanced content filter ran at the nation state level. ISPs all over the world filter content, its nothing new, the ISP is just ran by government in this case.
    – Ramhound
    Oct 24, 2012 at 15:57

While Google does send similar warnings, this one is clearly a phishing scam trying to steal your account.

Phishing scams include e-mails that request your login:password information, or links to fake web-sites that ask for your login:password. For web-sites, the printed link may look valid but the actual link could go someplace different. They often include threats of closing your account if you don't respond. If the message didn’t come from an @google.com address, it is fake.

You can ignore it, use the drop-down menu next to reply to "Report Phishing", or use the following form: http://mail.google.com/support/bin/request.py?contact_type=abuse_phishing picious messages: http://mail.google.com/support/bin/answer.py?hl=en&answer=29381

  • The links in the email message copied by OP are links to Google site (not a spoofed link). Also, the link is to a "reset password page", not a "login page". All this points to it being a valid email from Google. So, what makes you think it is a "phishing scam" ? What further checking should the OP do to verify if it is "phishing", or not? Nov 14, 2016 at 16:42

You must log in to answer this question.