Find the computer sending the traffic first. Note the address and time Google shows, look up the blocklist named in the bounce, clean or rebuild that machine, block direct outgoing mail at the router, then request removal.

A code to type before every search

At a small clinic, the receptionist searches Google and gets a plain page instead of results. It says unusual traffic is coming from the clinic's computer network.

Typing the distorted letters it shows lets her through, until the next search. By the afternoon, every computer in the office is getting the same page.

The same week, some outgoing emails bounce with a notice saying the office's address is on a blacklist. Both messages point at the same cause.

One address for the whole office

An office connection usually has one public internet address. Every computer, phone and tablet on the network, Wi-Fi included, reaches the internet under that one address.

Google sees only that address, and so does every mail server the office writes to. Neither can tell which machine inside sent anything.

So when one infected computer sends spam or automated searches, the whole office is treated as the sender: Google asks everyone to prove they are human, and blocklists name the address.

Where the traffic comes from

Look for the cause among everything that shares the connection:

The third is the one nobody thinks to check, because it does not belong to the office at all.

Reading the two messages

Google's page shows the office's public address and the time of the block. Write both down; they are the first two clues.

Mail servers check the address handing them each message against public blocklists. If your mail leaves from the office's address, or your provider checks that address, a listing turns into refusals.

The bounce usually names the list, often with a page where any address can be looked up. Some lists say when and why an address was listed, and a few name the infection they saw.

Finding the computer

Compare those times with who was in that day and which machines were switched on. Then look at what each device sends.

Spam from an infected computer usually goes straight to other mail servers on port 25. Many office routers can log outgoing connections by device, and an office computer using that port stands out.

Then check each machine: a full scan with current security software, the installed programs and browser add-ons, and anything starting with Windows that nobody recognises.

A worked example

A charter bus company runs bookings and dispatch from a small office beside its yard, with four computers, one more in the drivers' room and Wi-Fi for drivers between trips.

Quotes to tour operators began bouncing, and the dispatcher met Google's code page several times a day. The bounce named a blocklist that said the address had been sending spam.

The office computers scanned clean. The drivers' room computer, used for personal browsing under an administrator account, was sending mail directly on port 25.

It came off the network, its files were copied, and Windows was reinstalled from scratch. The router now refuses outgoing port 25, and drivers' phones use a separate guest network.

With nothing sending, Google's block lapsed on its own. After a quiet week, the company asked the list to remove its address.

Cleaning it properly

Disconnect the computer first, Wi-Fi included, so it stops sending while you work. A full scan may find the program, but infections often add helpers and switch off updates.

On a machine that holds business records, the surest repair is to copy the data files, erase the drive, reinstall Windows and programs from original media, and restore only the files.

Then change every password typed on it, from another machine: email, banking, the booking system and website logins. Check the email account for forwarding rules nobody set up.

Asking to be taken off the lists

Ask for removal only after the cause is gone. A list that sees spam again soon after delisting simply lists the address again, and later removals can be slower.

Each list explains its own process on its lookup page. Some drop an address after a quiet period; others need a short request from its owner.

One kind of list accuses nobody: it holds addresses that internet providers say should not send mail directly. If that is the only listing, send through your provider's or host's mail server.

Google's page has no removal form. Once nothing on the network sends automated requests, it stops appearing.

Keeping it from coming back

Have the router refuse outgoing port 25 from every device except an office mail server, if there is one. First make sure every mail program sends on the submission port, usually 587.

Put visitors and staff phones on a guest network kept apart from the office computers. Work under ordinary user accounts, and retire computers that no longer get security updates.

And name one person, on staff or an outside technician, who gets the call when the code page appears.

The counter-case

Google's page is not always a sign of infection. Offices sharing a building's connection inherit each other's traffic, and software that checks search positions can trigger it too.

A code page that appears once and never returns is not worth an investigation. And an office whose mail provider never checks the sending computer may see no bounces, even while infected.

But a bounce naming a blocklist, or a code page that keeps returning, means something on your network is misbehaving, and finding it properly is worth a technician's time.

Clearing the office's address

  1. Write down the address and time Google shows.
  2. Look up the list named in the bounce.
  3. Compare the times with who was in.
  4. Check every device on the network, guests included.
  5. Rebuild the infected computer and change its passwords.
  6. Block outgoing port 25 at the router.
  7. Request removal after a few quiet days.

Step four is where small offices go wrong. They scan the computers they own, find nothing, and miss the visitor's laptop or the old machine in a back room.

A July post, donate buttons quietly pointing to another account, traces another fault found only through its symptoms: a payment button altered to send gifts elsewhere.

Frequently asked questions

Will the code page go away by itself?

Yes, shortly after the unusual requests stop. There is no removal form for it, so the only fix is finding and stopping whatever is sending them.

Why does Google ask everyone in the office to type a code?

Google sees one public address for the whole office. When something on the network sends automated requests, it asks every computer at that address to prove a person is searching.

Why are our emails bouncing?

Mail servers check the address handing them each message against blocklists. If your office's address is listed and your mail leaves from it, some recipients refuse the mail.

How do we find the infected computer?

Compare the listing time with who was working, look for any device making its own connections on port 25, and check every machine, including visitors' laptops and old computers.

Is a virus scan enough?

Sometimes. On a computer holding business records, copying the data files, erasing the drive and reinstalling is safer, followed by changing every password typed on it from another machine.

When should we ask to be removed from the blocklist?

Only after the cause is fixed and the address has been clean for a few days. An address that sends spam again after removal is listed again, and later removals can be slower.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Google asking your office for a code?

Tell us what the bounce notice says, and we will help you find the device responsible and request removal properly.

Start a Conversation