Email attempted hack china - Page 1
Forum section: electronics / general

author: Deathwish
author_rank: Unknown
timestamp: August 06, 2015, 07:24:47 am
content: Ok so I have an email account I set up purely for my Aliexpress purchases, today I got a warning from microsoft to say they had stopped an attempted log in to my email address from china.We detected something unusual about a recent sign-in to the Microsoft account ga*****@gmail.com. To help keep you safe, we required an extra security challenge.Sign-in details:Country/region: ChinaIP address: 157.122.96.14Date: 8/6/2015 2:11 AM (GMT)If this was you, then you can safely ignore this email.If you're not sure this was you, a malicious user might have your password. Please review your recent activity and we'll help you take corrective action.It is a genuine microsoft alert.

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 06, 2015, 07:27:39 am
content: A genuine Microsoft alert about a gmail address?

author: T3sl4co1l
author_rank: Super Contributor
timestamp: August 06, 2015, 07:28:58 am
content: Post the e-mail headers.Tim

author: Deathwish
author_rank: Unknown
timestamp: August 06, 2015, 07:35:55 am
content: I have edited out my email acct details with ***Delivered-To: g*******@gmail.comReceived: by 10.107.178.74 with SMTP id b71csp724170iof;Wed, 5 Aug 2015 18:11:56 -0700 (PDT)X-Received: by 10.202.178.212 with SMTP id b203mr10388334oif.0.1438823516054;Wed, 05 Aug 2015 18:11:56 -0700 (PDT)Return-Path: <account-security-noreply@account.microsoft.com>Received: from BAY004-OMC4S12.hotmail.com (bay004-omc4s12.hotmail.com. [65.54.190.214])by mx.google.com with ESMTPS id q14si3360059obe.61.2015.08.05.18.11.55for <g******@gmail.com>(version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);Wed, 05 Aug 2015 18:11:56 -0700 (PDT)Received-SPF: pass (google.com: domain of account-security-noreply@account.microsoft.com designates 65.54.190.214 as permitted sender) client-ip=65.54.190.214;Authentication-Results: mx.google.com;spf=pass (google.com: domain of account-security-noreply@account.microsoft.com designates 65.54.190.214 as permitted sender) smtp.mail=account-security-noreply@account.microsoft.com;dmarc=pass (p=NONE dis=NONE) header.from=account.microsoft.comReceived: from BN3SCH030020530 ([65.54.190.199]) by BAY004-OMC4S12.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008);Wed, 5 Aug 2015 18:11:55 -0700Message-ID: <BN3SCH030020530B7B1C85BF6F5F561B6FF8A740@phx.gbl>X-Message-Routing: sKFde7CS5BHygFZaC4gFZWeHmOM+Rjf1iOmv8meDbQqeD+9kHFgbAflrz5UYy6v/Ov/vRliTx0hzi7ScTgwYCoH5DCiLmM++f1gUyuZGBRCDm6mCEyrHK6bOjDP+ydMF/ithO6/hmsEFqivuG3Gtd1L7O4g==Return-Path: account-security-noreply@account.microsoft.comFrom: Microsoft account team <account-security-noreply@account.microsoft.com>To: g******@gmail.comDate: Wed, 05 Aug 2015 18:11:54 -0700Subject: Microsoft account unusual sign-in activityMessage-Id: <1dd6b9d2-7a63-5f27-08c7-19b8cf06d7f0@BN3SCH030020530>X-Priority: 3X-MSAPipeline: MessageDispatcherX-MSAMetaData:=?us-ascii?q?DBRBlsMUUmxXe8ltnASOduwdm6DpFhgoAcSNjZRCsWC3dFRM2FXDjSDmRxeZa?==?us-ascii?q?lIxf5kYWb09OxNz7IqUOJqY0TCBhZLN?=MIME-Version: 1.0Content-Type: multipart/alternative; boundary="=-Pv57QsgIeCTM8fPlOPlbcQ=="X-OriginalArrivalTime: 06 Aug 2015 01:11:55.0491 (UTC) FILETIME=[E298EB30:01D0CFE4]

author: T3sl4co1l
author_rank: Super Contributor
timestamp: August 06, 2015, 07:47:24 am
content: Not sure about the identifying info (if any; lots of hashes I'm sure), but it originates from 65.54.190.199 which says Redmond, WA.Beats me why Microsoft sent it, though.Guess I'd suggest using a potentially-disposable address for communications such as these. Also, check that your password isn't short or easily guessed (ideally, go download some rainbow tables and check for occurrences or similarities?), or change it to one that is secure.Tim

author: Deathwish
author_rank: Unknown
timestamp: August 06, 2015, 07:51:17 am
content: Quote from: T3sl4co1l on August 06, 2015, 07:47:24 amIt is a throw away one Tim, been around newsgroups etc too long for that mistake. The password is also alphanumeric and rather long, I used a mag card reader and card for a password.

author: G7PSK
author_rank: Super Contributor
timestamp: August 06, 2015, 07:59:09 am
content: I would treat the e mail that is purports to be from Microsoft as a clever phishing attack but also assume that an attack has been attempted on your G mail account and change your details there or even create a new account. Phishing attacs are getting very sophisticated now I have had some which even had some correct details in them indicating that a fair bit of research went into the individual attempts. I have had 2 phone calls over the past 2 days using a phone number and name that the only other people who have it is Amazon the phone calls start out saying they are from the "verification department" (of what they wont say) and did I know that "6 new computer had been added to my network" when I ask who is my ISP then they hang up.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: August 06, 2015, 07:59:19 am
content: Ah, then no harm at least.Tim

author: andersm
author_rank: Super Contributor
timestamp: August 06, 2015, 08:06:39 am
content: Quote from: PA0PBZ on August 06, 2015, 07:27:39 amYou can use any email address as the username for a Microsoft account (seesignup.live.com).

author: Jeroen3
author_rank: Super Contributor
timestamp: August 06, 2015, 08:16:07 am
content: Microsoft's account recovery is the poorest ever. My account got taken twice by a guy with the same name by only entering his @.nl e-mail and his phone number.I received a text telling the recovery phone number of my account was changed to .I went on the pc, restored my account and called the guy. Turns out he was attempting to restore his account, which was eg: JSmith, and mine was J.Smith.Weirdest conversation ever, someone with the exact same name picks up the phone...

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 06, 2015, 08:48:03 am
content: Quote from: andersm on August 06, 2015, 08:06:39 amI know, but the first line in the first post suggests otherwise. It still sounds to me like Keysight sending you an email that there is an update for your Rigol scope...

author: Deathwish
author_rank: Unknown
timestamp: August 06, 2015, 08:57:46 am
content: I have a number of email addresses each related to the subject I do, I have one for photography, one for mechanics and so on. The one above is for this forum and aliexpress. I have only had the hack attempt since ordering from Aliexpress. It caused me not so much serious concern but annoyance.

author: Bob F.
author_rank: Regular Contributor
timestamp: August 06, 2015, 11:52:44 am
content: It may be an app running on your phone or similar automated system you have set up to fetch your emails triggering an alert on Hotmail's systems (tho coming from China, that seems unlikely).If you look in your Recent Activity on Hotmail you can get the IP address of the device trying to log in as you and find out who they are that way (hopefully)[ edit: I see you already have the address... Just googled it and it is on several spam blocker lists].My only worry is that the only time I have had a security challenge from Hotmail is when I have already logged in and I go to make changes to my account settings, so in your position I would change my password however good it is as it is possible someone has it.

author: Deathwish
author_rank: Unknown
timestamp: August 06, 2015, 11:55:02 am
content: I don't have Hotmail never will , its a pos. I did check my gmail acct to see what had tried to log in but it only shows my pc and phone which is not surprising as microsoft said it blocked the access to my gmail, i also set it up to alert me by phone for any log in activity.

author: Wilksey
author_rank: Super Contributor
timestamp: August 06, 2015, 12:02:50 pm
content: If it is a GMAIL account, I have found that if signing in from a different device from a different country then Google will ask me to verify by form of a number sent via text message to my phone.

author: andersm
author_rank: Super Contributor
timestamp: August 06, 2015, 12:16:11 pm
content: Quote from: Deathwish on August 06, 2015, 11:55:02 amThey didn't block an access attempt to your Gmail, they blocked an attempt to access aMicrosoft accountthat uses your Gmail account as the username. If you've used that email address when registering for Skype, MSDN, Xbox Live or some other Microsoft service, you have created a Microsoft account.I'm guessing your Aliexpress partner (or whoever stole your email address from them) automatically tries to log into different services to steal whatever they can.

author: Deathwish
author_rank: Unknown
timestamp: August 06, 2015, 12:23:58 pm
content: Ahh, no I dont have any of those things. But I will keep an eye out.

author: Bob F.
author_rank: Regular Contributor
timestamp: August 06, 2015, 01:25:43 pm
content: Quote from: Deathwish on August 06, 2015, 11:55:02 amThe email is from Microsoft/Hotmail, not from google/gmail. You have presumably set your gmail account as your backup email address within Hotmail so you must have used Hotmail at some point in the distant past - even if you didn't realise it.If you no longer use it for anything, I would strongly advise going in and closing the Hotmail account as it is still live even though you do not use it any more and if they get in to your account settings there they are some way towards identity theft (depending on what else they may know about you) - or at the very least, using the account for other nefarious purposes.

author: Deathwish
author_rank: Unknown
timestamp: August 06, 2015, 01:32:22 pm
content: I have never ever used hotmail, not for anything ever, prior to google I had a email address with a now defunct ip called erm yeah, freeserve.co.uk i think. Prior to that nothing.

author: Bob F.
author_rank: Regular Contributor
timestamp: August 06, 2015, 01:37:22 pm
content: In that case, it looks like someone has made a typo and set your gmail account as their backup email address!That makes this a SEP* issue then ;-)* (c) Douglas Adams