Hacked mail ?

Krony · 30 Oct 2011 at 21:56

Had this a few weeks ago and changed my password but it looks like this account has been accessed again by other than me, u can see the login from Spain a few weeks ago and now there is some US logins, any ideas ?

Philtor · 30 Oct 2011 at 22:32

Have you run a full scan with your AV and Malware bytes?

Krony · 30 Oct 2011 at 23:04

I run spybot and malwarebytes normally once a week as well as mse, just ran them again and nothing.

KIA · 1 Nov 2011 at 15:49

Enable two-step verification!

http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html

The US IPs are owned by Microsoft. Looks like someone with Hotmail is accessing gmail using POP3.

Krony · 1 Nov 2011 at 16:05

I have set that 2 step verification up now, i do have my hotmail account linked to this account as i mainly use that so could thoes US ones be the emails going to my hotmail account ?
Also after changing my password again and setting up thet 2 step thing yesterday morning i did recieve 2 texts from google with verification codes that i did not request which seems to point to the fact that someone got past the password again but got stuck on the second step and requested codes or could this have been generated by my hotmail account again ?

div0 · 1 Nov 2011 at 16:06

Check your Mail Settings and check that when they logged into your account, they didn't just set it up to Pop mail to another email address?

Then if they did set up any kind of Forwarding, remove it and change your password again.

div0 · 1 Nov 2011 at 16:10

edit - just read your update.

My guess is that it's just your Hotmail forwarding. Can't you get hotmail to scan for mail, then check if the date/time matches in gmail?

Or if in doubt, disable the hotmail forwarding for a few days and check if the logs stop in gmail. Then re-enable your forwarding, and check again?

/double edit - the texts are likely for any applications that need to access you email (like the hotmail forwarding).

I had issues with someone logging into my gmail account several months back and since using the 2-step verification, I've had no issues.

KIA · 1 Nov 2011 at 16:11

Krony said:
I have set that 2 step verification up now, i do have my hotmail account linked to this account as i mainly use that so could thoes US ones be the emails going to my hotmail account ?

Yeah, most probably.

Krony said:
Also after changing my password again and setting up thet 2 step thing yesterday morning i did recieve 2 texts from google with verification codes that i did not request which seems to point to the fact that someone got past the password again but got stuck on the second step and requested codes or could this have been generated by my hotmail account again ?

You will need to create a unique password for the Hotmail account to use or you will continue to receive the notifications. It's under the same area. http://krebsonsecurity.com/2011/02/google-adds-1-time-passwords-to-gmail-apps/

Krony · 1 Nov 2011 at 16:41

Yea, i'll look into that thx, i have noticed the emails from the google address don't show up now in the hotmail account and i guess this is because of the 2 stup verification.
Thx for ur help anyway but it seems apart fromk that Spain login a month ago it's just my hotmail account retrieving the mails.