Security Blog

The latest news and insights from Google on security and safety on the Internet

Detecting suspicious account activity

24 mars 2010
Share on Twitter Share on Facebook
Google

57 commentaires :

JulienRAMES a dit...

How do you plan to do if someone is sometimes connected through a VNP which is situated abroad ?

24 mars 2010 à 12 h 38
coolbop a dit...

Just out of interest, is this message only shown to someone that logs in again with the original IP address range? And are they the only person that can dismiss this message?

If not, it would be trivial for a hacker to dismiss the alert without the account owner ever seeing it.

24 mars 2010 à 13 h 01
Hayden a dit...

This is a great addition! I would still like to see an option verify via SMS when making any changes to passwords and recovery options. If a hostile person gains access to your account by knowing your password, they could quickly change it and all your recovery options before you even see the alert, potentially losing access to your account for good. (this happened to my fiancée)

24 mars 2010 à 13 h 56
bboissin a dit...

It would be even better if the "connection detail" window had support for IPv6.

Currently it doesn't even show the hex address, it just shows "unavailable".

(the help would need to be fixed, there are some information that is only relevant to IPv4)

24 mars 2010 à 15 h 50
Unknown a dit...

This is a step in the right direction, but I was really hoping that one could configure Gmail to require Captcha or some other challenge/response if attempting to log in from some unusual location or IP address (based on previous activity).

How you implement this is up to you... maybe I could opt into such a service that would "reject" my valid authentication credentials (as if it wasn't correct) and ask me to enter it again... this time with a Captcha.

24 mars 2010 à 23 h 06
Jesse a dit...

My email account jesseinfo@gmail.com was taken over this morning and they started sending out emails like the one mentioned. I filled in the gmail form but the gmail team did not believe I was the owner of the account. All I want is for the account to be permanently close. Please help me!

24 mars 2010 à 23 h 49
Unknown a dit...

I'm trusting that google has made this system so its intelligent enough to notify the actual account holder of access discrepancies, rather than the attacker - who'd love to change your password immediately. This would be done, of course, by the same method of ip recognition, such that when you access via a familiar IP you receive the message, allowing you to change your password.

25 mars 2010 à 01 h 30
VadisH a dit...

Suppose my account has been compromised and I the warning message get displayed. Can't just hacker click the "ignore" at the above red warning message and the notification about stolen identity will be dismissed or am I missing something...?

25 mars 2010 à 03 h 58
Ratzlaff a dit...

This is great. Another nice feature would be assist the user in geolocating the origin of incoming emails. This would help greatly against phishing campaigns if the user could see that really nice deal from PayPal originated in Nigeria.

25 mars 2010 à 10 h 36
Technical Moksha a dit...

Great in theory this sounds very good, but will users have the options to white list an incident trigger. For e.g when using proxy's or corporate/personal VPN's???

What about proxy relay networks such as TOR that hope server/locations???

25 mars 2010 à 13 h 39
Kimo C a dit...

It would be great if you could use derived location on the mobile devices based on their wifi/gps/cell towers to refine the location of the usage rather than the broad geo info based on IP address.

25 mars 2010 à 13 h 41
Unknown a dit...

Will there be a way to permanently add an authorized location? For example, a person lives in San Jose California, but his office proxy is in NY City. If he checks his email from the office with its IP geolocated to NYC, then drives home and 30 minutes later checks his email from home with his IP geolocation of San Jose, will he constantly be getting warnings or can he add both locations as valid or "safe"?

25 mars 2010 à 14 h 20
Unknown a dit...

I recently got hacked by the London guy. These security tips don't really help because he changed my password so I couldn't log in and is currently sending emails with another account.

Does anyone know how to disable sending emails from alternate addresses?

My understanding is that you can type in an alternate email address and all gmail does is email's the other address to "Confirm" that its yours. The only way to stop this is by ending it on the other email address.

Problem is, the hacker has access to his personal account, with which he can still send emails from pretending to be me.

25 mars 2010 à 17 h 35
Fergal a dit...

This is a feature I'll hopefully never use - and paradoxically, one its great to have.

GeoIP databases have been around for years, the IPs are logged anyway - and yet of all the online services I use (banking, ecommerce) Gmail is the only that will warn me if this sort of thing happens.

Nice one, Gmail team.

25 mars 2010 à 19 h 18
Unknown a dit...

hello , i received a email from my wife this morning with the same warning you showing here Pavni Diwanji, Engineering Director
( Detecting suspicious account activity ) , the person is been sending email everybody in her contact list and my wife is not in the town , wht should i do everyone is calling me , can u please help me

26 mars 2010 à 11 h 10
Unknown a dit...

I often get messages to compromise my information through gmail.
I'm thankful that those in charge of gmail accounts have been doing a great job filtering these spam garbage emails.

26 mars 2010 à 14 h 09
PM a dit...

This is a great feature but does it stop someone from using a your ISP address as proxy address and then logging on ?

In friend circle this can happen when someone has recieved an email from you and then uses somewhat similar IP address to log into your account.

27 mars 2010 à 01 h 47
Ramya a dit...

I definitely appreciate the idea behind this. But since morning I have been trying to figure why my most recent access is some place in new york in "2009". I agree if there has been something like that in the past few weeks it makes sense to report it to the user. But a timing like that made me wonder if system time is off on any computer i use. And only at the other end of a long malware search do I read this article and presume the code looks through more than two years of ip address logs??

27 mars 2010 à 03 h 57
Unknown a dit...

Interesting that this post was made this weekend - as my wife's account has been hijacked by hackers. They have changed her password and security question multiple times, and she is currently locked out, while the hackers have free reign. We have tried to contact Google security, but received a message that the security mailbox (security@google.com) is over quota. Is there some other route we can use to contact the Google security team?

28 mars 2010 à 16 h 33
Anonymous a dit...

I have gotten a few emails from the Gmail team that state my account will be shutdown unless I provide my full name, Password, Phone # and Country. It is strangely worded and I am suspicious. Is this for real--is there anyone I can contact at gmail to verify authenticity?

28 mars 2010 à 18 h 45
Unknown a dit...

I (and my family just received the following email from my gmail account (which has been hacked in this manner)... How can I get my account locked quickly? (the hacker changed the password)

ffthack@gmail.com --- email follows---

I'm sorry for this odd request because it might get to you too urgent but it's just the situation of things right now, we are presently stuck in Scotland, we came down here on vacation. we were robbed, worse of it is that bags, cash and credit cards was stolen at GUN POINT, it's such a crazy experience for us and we need help with flying back home, the authorities are not being 100% supportive but the good thing is we still have our passports but don't have enough money to get on a plane back home, please we need you to loan us some money till we are back home to refund it back.

Thanks,
Ian.

29 mars 2010 à 09 h 23
BodyTalkerLisa a dit...

This same thing happened to a friend of mine, but what happened to me while she was having this problem, I had I got a weird highlighted warning message flashing above my email's area where I view all my messages. It wanted my user word and password , to see if it was correct. Since I have never seen anything like that before I ignored it thinking it was not referring to me and that maybe someone highjacked my account as well. Lisa Seward

29 mars 2010 à 22 h 42
Unknown a dit...

I appreciate the improved information on account activity, but would much like to understand how it can be that I repeatedly find the message 'this session may be open in another location' (sorry have forgotten exact text) given that I ALWAYS and INVARIABLY log out, and have my browser set to store no passwords and to delete all information upon exit. Is someone hacking my email from my own PC? If so, how? I have it firewalled, silent (effectively invisible on the internet), clean and free for viruses, have never found trojans on it, am the only one using it, and have a password for it. I even lock down the firewall at night. Note it happens more often to 1 account that I access at work, and so which may be subject to password theft via keyloggers. But, it happens too to my very private account that I never open except here at home. Many thanks in advance for input on this, how it can happen and what to do. E

29 mars 2010 à 22 h 45
bloops a dit...

My email address was also compromised by a scammer (probably the same) who sent out email to all my contacts asking for money for being stuck in London. The problem is the scammer also changed my password and secondary email address so I cannot access my account.

I have already filled out the account compromised form but nothing happened. I also have email forwarding and sending set-up from my other account so I have definite proof that I own the account. Please help!

30 mars 2010 à 01 h 37
Unknown a dit...

Please make a possibility to block access from china to someone's gmail account at all!!!
My account was hacked yesterday. I don't know HOW!

31 mars 2010 à 12 h 56
awheckman a dit...

I see that one can turn off alerts after waiting a week, which gives a valid user a week-long chance to log in and notice before a bad guy can avoid alerts. That's good. Let's say, however, that I am a frequent traveler between 2 different countries. Would I expect to get an alert each time I fly because I check email in country A and then a few hours later in country B? Or does the automated system learn from the recorded activity what is normal for me? What about having a more flexible alert configuration, where I can say "turn off alerts for countries A and B only" rather than turning off all alerts? That could be an option next to each activity record.

31 mars 2010 à 17 h 10
unknown a dit...

hi. i just received a likewise email from my friend who. her gmail account was hacked and now she cant sign in to change her password. the scammer/hacker also hacked her yahoo account. but she is able to retrieve the account, and found out a new email backup on her account she believes is the hacker: dannypoljak@gmail.com. where can i report this misuser?

1 avril 2010 à 19 h 38
François Marier a dit...

It would be great (especially for those of us accessing GMail through IMAP) to have these security warnings available through a private RSS feed.

2 avril 2010 à 07 h 16
Unknown a dit...

Is this alert already working? I tried to access my mailbox directly and through a proxy to change my IP source's country and I didn't receive any alert.

2 avril 2010 à 09 h 19
Saqib Ali a dit...

Is the suspicious behaviour is tagged for 'all' types of access (IMAP, ActiveSync, MAPI, GTalk etc) or just for Gmail Web UI.

2 avril 2010 à 12 h 59
Carl Dalid a dit...

I need help everyone. My email and paypal account just got compromised last 14th of April. I made a transaction the fraud who compromised my email, paypal account and bank account. I don't know how he did it but he did! He made unauthorized transactions and transferred all my funds to his own paypal account before closing my account. PayPal made an investigation about the case and made a conclusion that there was no third party access to my account and closed the investigation. It was really upsetting! It left me nothing but hoping to prove that it was totally the fraud who closed my account since he got access to my email, my paypal and knows my bank account through our first transaction. Since paypal wasn't able to see see any third party access, if I could just prove that the IP address that accessed my email also accessed my paypal account, it could prove that it wasn't me who made the transactions and closed my account. Can anyone suggest how I could do this?

18 avril 2010 à 10 h 44
Unknown a dit...

This alert is working and have provided me the valuable information about the recent account compromise. Unfortunately the damage was already done (not much, but unpleasant). At the same time this incident have shown me how sensitive indeed the information stored in my Gmail acc is. I have thought a bit how I would like to improve security (including taking my info back to PC - discarded as not secure). Here are some suggestions:

1. Provide a gadget or an iPhone app to generate a temporary secure number in addition to the password (just like Blizzard provides for its BattleNet users - very, very convenient and unbreakable - take a look, it's nice). I WOULD GLADLY PAY FOR SUCH A FEATURE.

2. My account was compromised from a South Korean IP. Why don't provide an option to restrict the access geographically? It's not a 100% solution, but still an improvement.

3. I would like to press a button near this South Korean IP address: "yes, this is a bad intrusion, not a false positive". The lists of these IPs addresses can be later shared with law enforcement.

Thank you.

4 mai 2010 à 22 h 20
Unknown a dit...

My account has just been conpromised. As the hacker logged in to chat, I see it as I was using another account. So I logged in before the password is changed. I get lucky and I can get in and change the password. The strange thing is his/her IP is not even in the list of recent activity!. I wonder how he/she manange to do that. Is there a setting that allow users to do that? So please help me.

19 mai 2010 à 23 h 46
Osman Gürsoy a dit...

Just put a notification on front page saying last login date and time. So We will know whether someone else uses my account or not!
What do you think?

26 mai 2010 à 04 h 54
StephenJ a dit...

Hello....yesterday my account was compromised as well. The same e-mail has been sent to all of my friends and family, some of whom have corresponded and had conversations with the impersonators. They have also deleted my facebook account. I have lost vital work-related material that was on the account. I am very upset that Gmail has no interest in helping me. I don't know what to do. I may lose my job because of this. I have filed a complaint with the indicated ic3.gov form for white collar crime but have heard nothing. I have also called Google and was told they couldnt help me. I have filled out the account impersonation form for Gmail and that was fruitless. The hacker has also changed the alternate email address and have locked me out completely, preventing me from changing my password. Does anyone have the solution? All that essentially needs to be done is to verify the user and then simply deactivate the damn account. What is the big deal? Thanks for nothing Gmail. I will be letting everyone I know and current friends and family who use Gmail that they should go to another server and start a new email address and cancel their Gmails because this could happen to anyone and Gmail will do nothing to help.

3 juin 2010 à 23 h 04
Unknown a dit...

Are OAuth logins whitelisted? It would defeat the purpose of OAuth login support when suddenly all the users of our service would get a warning that their "account has be compromised" when our servers try to access their accounts.

30 juin 2010 à 18 h 15
tzm a dit...

Can get more detail of account activity rather than IP address ?
what i mean is if someone check from a public access center like a cyber cafe of an ISP ? now is we can only know the public ip address of the ISP.. can not know more than that..

30 juillet 2010 à 12 h 07
VadisH a dit...

tzm, great idea! I'd also like in case of suspicious activity to have an undo option on whatever happened whilst hacked connection.

31 juillet 2010 à 08 h 21
Revolutionary Sway a dit...

I'm not sure if what I received via a Google warning alert is the same thing mentioned here as the Google warning alert I received couldn't have been related to my email account do to the fact I received it the instant I logged
onto my brand new computer for the first time.
I'm curious if any one else has had a similar experience? The warning gave in depth details to
include the mobile phone number blocking me and redirecting all my Internet traffic and access. It gave me a detailed account
of the location i.e the hotel in the San Francisco area and even stated the person was located in the cafe within that Hotel.The alert also listed a lot of personal info about me as well as the hacker. Has anyone else experienced this type of Google alert? It was such a blessing when I received this alert as I had been blocked from accessing the Internet for at least 8 months. I knew it was my then estranged husband and upon Google sending me the warning alert providing me all the proof I needed against my now ex-husband. I took a snap shot of the warning alert and have made several copies buried with in numerous Cd's. I bring this up because My husband is a wolf in sheep's clothing within his Profession as an I.T & information security Consultant/Pro and very good at what he does. He has the power to turn a persons life upside down if he feels they are a threat. I had never heard about the Google e-mail alerts until now.

all comments appreciated.
thejusticetrain
a.k.a
roxyunscripted

1 août 2010 à 04 h 41
tzm a dit...

As far as i know , last account activity can't help much..
if someone use our mail from cyber cafes...those cafe ip are behind the firewall ip address of internet service provider..
last account activity can not pass the fire wall ip of the ISP
..so can't get exact location

5 août 2010 à 10 h 04
RBDurgin a dit...

Where do we send reports of unauthorized access to?

14 août 2010 à 17 h 05
Unknown a dit...

I have to say... I am a bit mad that I have been locked out of my account due to "suspicious activity" and since my phone does not allow texts I had to fill out a form that requires 24 hours of investigation. I need to use my e-mail now, but I'm stuck with this problem.

I just used my e-mail yesterday night and I checked it today and didn't even let me sign in, it just locked me out saying that due to suspicious activity on the account I need proof some of the info I don't even remember because it was so long ago.

I used my brothers account to post this

4 octobre 2010 à 23 h 58
Unknown a dit...

This IP address is hacking gmail accounts and sending spam out to all the contacts in the account

Browser Italy (115.52.226.160) Nov 8 (1 day ago)

You should BLOCK them from ever accessing google. Or find a way to prevent this.

9 novembre 2010 à 14 h 28
Jay a dit...

aashna,

Thank you for your report. We have sent it to the appropriate teams for investigation.

Google Security Team

11 novembre 2010 à 13 h 27
domakesaythink a dit...

Hi,

My brother had this incident where a malicious person hacked his gmail account and deleted e-mails.

We actually know who is this person (he did this from his home connection, the IP address matches emails he has sent us) and we pressed charges but the Police told us that we should try and contact Google to make sure the Access logs for the gmail account are not deleted... Police investigations in Portugal take forever and I have screenshots of the "Activity on this account" screen showing the entries that correspond to the ilegal activity but those aren't valid in court.

who should I contact about making sure that those access logs don't get deleted? so when the Police makes the official request for them they are still there.

Cheers,
Francisco

15 novembre 2010 à 06 h 27
Jay a dit...

Francisco, Law Enforcement should request preservation. They can contact their regional Legal Attache office for guidance.

Jay, Google Communications

17 novembre 2010 à 14 h 52
Unknown a dit...

My google account activity continues to say that my IP address is from United States, NY (where I was last year) even though I am now in South Korea? The account activity and my use of gmail match up fine (ie it logs perfectly when I've used gmail 2 minutes, 1 hour ago etc), but for some reason the IP location for al this activity keeps saying New York? Is there something wrong with my computer?

11 janvier 2011 à 17 h 44
R@jU a dit...

On the recent activity window the hacked ip address is red marked ,if the google automatically tell these users r hack ur mail or its our duty to check anybody will hack our page r not ....................

pls on help how to view all the recent activity address for a month r a year............

is the red marked only the hacker r any thing not been marked?

24 août 2011 à 05 h 43
sivaganga bejawada a dit...

Is there a way that we can put accessing filter at country level/ state level accessing of the account?.

6 novembre 2011 à 08 h 20
article43 a dit...

Can you please let me know how to leave this feature on, so that it shows the last ip address every time I log in.

Thank You.

3 décembre 2011 à 19 h 36
Glen Gage a dit...

I've had two such warnings but haven't ever found evidence of any use of my account by the hacker. Did they actually get access to the account or did you ask them security questions and so not let them in?

31 mai 2012 à 12 h 08
guran a dit...

How can I TURN OFF!!! this highly anoying and dangerous "feature". I travel frequently and DO NOT WANT or need my wherabouts to be emailed, in an unsecure message. This is so disturbing so i have to avoid using my Google-enabled devices in some countries I travel to.
This is a feature that should have a full "disable" mode but I have not found any way to turn it off!

13 mars 2013 à 02 h 20
Mike123996 a dit...

I live in Philadelphia, someone signing in from Washington dc ....can't I stop them. changing password constantly...google help, obviously not me two states one day

2 mars 2014 à 18 h 31
Mike123996 a dit...

Someone logging in from a different state can't stop them other than constantly changing password....two step verification not helping too much

2 mars 2014 à 18 h 33
007SQL a dit...

I am in a loop due to changing my password last night via Lastpass (which normally saves the new generated one properly, but didn't for some reason). so I tried again a couple times. I do remember a recent password, but not the most recent. Very frustrating to be in a loop locked out for "suspicious activity" on my own account due to some malefunction -and even my second factor is not working.

12 avril 2014 à 12 h 07
Unknown a dit...

I have the statement my account is open in another location. When I click on details, it does not show a valid IP address but it shows * United States (OH) (2602:306:cd59:e140:8c17:7d5b:828:4de8) I have changed my Password, and it came right back. Is this something I should be worried about?

26 mai 2014 à 20 h 57
Unknown a dit...

My Gmail was hacked this morning - and I have not receiven any emails regarding unusual activity. I would like to know if you can help me restore the mails ... Contacts are in place and all settings have been reset to MY settings. Please contact me on akorsholm. Thank you!

10 juin 2014 à 09 h 28

Publier un commentaire

  

Libellés


  • #sharethemicincyber
  • #supplychain #security #opensource
  • android
  • android security
  • android tr
  • app security
  • big data
  • biometrics
  • blackhat
  • C++
  • chrome
  • chrome enterprise
  • chrome security
  • connected devices
  • CTF
  • diversity
  • encryption
  • federated learning
  • fuzzing
  • Gboard
  • google play
  • google play protect
  • hacking
  • interoperability
  • iot security
  • kubernetes
  • linux kernel
  • memory safety
  • Open Source
  • pha family highlights
  • pixel
  • privacy
  • private compute core
  • Rowhammer
  • rust
  • Security
  • security rewards program
  • sigstore
  • spyware
  • supply chain
  • targeted spyware
  • tensor
  • Titan M2
  • VDP
  • vulnerabilities
  • workshop


Archive


  •     2025
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2024
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2023
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2022
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2021
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2020
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2019
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2018
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2017
    • déc.
    • nov.
    • oct.
    • sept.
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2016
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2015
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2014
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • avr.
    • mars
    • févr.
    • janv.
  •     2013
    • déc.
    • nov.
    • oct.
    • août
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2012
    • déc.
    • sept.
    • août
    • juin
    • mai
    • avr.
    • mars
    • févr.
    • janv.
  •     2011
    • déc.
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • juin
    • mai
    • avr.
    • mars
    • févr.
  •     2010
    • nov.
    • oct.
    • sept.
    • août
    • juill.
    • mai
    • avr.
    • mars
  •     2009
    • nov.
    • oct.
    • août
    • juill.
    • juin
    • mars
  •     2008
    • déc.
    • nov.
    • oct.
    • août
    • juill.
    • mai
    • févr.
  •     2007
    • nov.
    • oct.
    • sept.
    • juill.
    • juin
    • mai

Feed

Follow
Give us feedback in our Product Forums.
  • Google
  • Privacy
  • Terms