Login Attempts on All My Accounts?

EightImmortals on 01/12/2023 - 11:42

OK this weird, I'd expect one occasionally but so far today I had multiple 'attempted login' on various accounts including 1 gmail account, my binance account (not linked to the gmail address), one email account on a custom domain through gmail. Have checked haveibeenpwnd and nothing there. Doing a malwarebytes scan now.

Any ideas?

Computing

Comments

  • Cheaplikethebird on 01/12/2023 - 11:43
    +15

    Creds leaked on one of your accounts so they try the same password + email combo across a bunch of different websites. As long as you're not reusing the same password you should be pretty safe. Most likely an inconsequential account that got leaked.

  • Hybroid on 01/12/2023 - 11:44
    +1

    Your password manager password may have been compromised. Or you use the same password for multiple platforms.

  • EightImmortals on 01/12/2023 - 11:54

    Cheers, not as far as I can tell, my pw manager is offline (though I did have a db backup in drobox but some of the attempted accounts weren't in there). Currently getting a heap of detections in mwb, will be disappointed if Kaspersky didn't pick them up.

    I use different passwords for different accounts and so far none of the attempts have been successful.

    • Gdsamp on 01/12/2023 - 11:57
      -2

      Kaspersky

      Russian Malware

      • EightImmortals on 01/12/2023 - 11:57

        nyet.

        • H4nd0 on 02/12/2023 - 12:31

          You are most likely in the midst of an identity theft event via data breach.

          1. Purchase a new computer or use a separate computer (e.g. VM) for all the steps involved. You may have an undetected APT present.
          2. Get a new secure email address (e.g. Proton Mail) and secure with MFA (e.g. Authy, Yubikey etc.) for critical financial accounts (separation of identity)
          3. Assign the new email address to all your critical financial accounts
          4. Use strong unique passwords kept in a password vault (e.g. Bitwarden) that is secured with a master password and hardware key (e.g. Yubikey)
          5. Reset all passwords across all accounts.
          6. Ensure MFA is used on all email, Binance and all other accounts.

          I would personally reconsider the use of any Russian-nexus software product. There's plenty of other excellent EPP/EDR/XDR product out there.

          • EightImmortals on 02/12/2023 - 12:54

            @H4nd0: Thanks for that, not sure what this line meant though. :)

            "Russian-nexus software product. There's plenty of other excellent EPP/EDR/XDR product out there."

            Something to do with AV I guess? Any recommendations?

            • H4nd0 on 02/12/2023 - 12:58
              +2

              @EightImmortals: Anything non-Russian. Avast (Czech), BitDefender (Romania), ESET (Slovakia) etc. DYOR.

  • Drpepper666 on 01/12/2023 - 12:08

    Binance suss do you post on Reddit about crypto

    • EightImmortals on 01/12/2023 - 12:10

      Nope. I did an IP lookup on the Binance attempt and it came from Germany. The earlier gmail attempt was from Brisbane.

  • Protractor on 01/12/2023 - 12:16

    Optus customer?

    • EightImmortals on 01/12/2023 - 12:39

      ABB, I also have the phone with them which they use Optus for but none of those accounts have ever been used on it.

  • Sye on 01/12/2023 - 12:19
    +3

    How do we know you're not the hacker? Maybe you hacked this OzBargain account.

    • EightImmortals on 01/12/2023 - 12:44
      +2

      Lets talk about covid vaccines, that should settle it. :)

  • Leanne59 on 01/12/2023 - 12:26
    +2

    Two days ago I had someone delete the extra person off my Netflix account and add themselves. Thought it was spam when I received emails until I checked my Netflix account.

  • localhost on 01/12/2023 - 12:29
    +2

    More like your pc is hacked, malware or something like that. Use 2FA for important accounts.

    • randomusername2017 on 01/12/2023 - 12:36
      +1

      username checks out…

      • localhost on 01/12/2023 - 12:41
        +2

        Add this to standard OzB comments you see :)

  • ddilrat on 01/12/2023 - 12:41
    +1

    Won't show up straight away on haveIbeenpwned.com and they also don't show every leak. Doubt your password manager has been compromised. As someone has mentioned they probably have got one of your credentials or what they think are your credentials and are just trying them on everything.

    Can't hurt to reset all of your important passwords but I wouldn't do it on your usual device.

    • EightImmortals on 01/12/2023 - 12:46

      Cheers, strange they would have a few different account though. And was just talking to my son and he got the same warning on his hotmail account, totally different PC and the account has never been used on my machine. Just weird.

      • ihfree on 01/12/2023 - 13:19
        +1

        If there are services you both use, that may help narrowing down where the leak came from.

  • Protractor on 01/12/2023 - 12:50
    -1

    Not sounding good

    • Protractor on 01/12/2023 - 14:35
      +1

      Haha Negged for stating the obvious. Amaze-balls (add to common words phrases thread)

  • welcomeUniverseWorld on 01/12/2023 - 13:42
    • Change all your password and make it stronger
    • Use different emails for different places.
    • Change your name
    • Change your look
    • Get a new haircut
    • Color your hair
    • Grow a beard

    Do not panic. Firstly, scan your laptop. Then change all your password. Double check your bank accounts for any suspicious things. Maybe think about changing the credit card by calling your provider. They usually will send you a new card number card. etc etc

    • Protractor on 01/12/2023 - 14:36

      weak link Pornhub

  • Typical16-bitEnjoyer on 01/12/2023 - 16:24
    +2

    Told ya you had malware a week ago

    https://www.ozbargain.com.au/comment/14608546/redir

    • EightImmortals on 01/12/2023 - 16:28

      :) Different PC, that one belonged to someone else I was helping out. :)

  • Protractor on 01/12/2023 - 16:32

    other weak link any site where anti vaxxers and conspiracy jibbering takes place, including emailing or PM-ing them as though there was some sort of bonus trust factor.

  • mskeggs on 01/12/2023 - 19:47
    +1

    Everyone here is suggesting random untargetted stuff, as that is usually most likely.
    Consider you may have pissed somebody off and they are personally targeting you, not just a random thing.
    I’d be on my guard for spear phishing and watching my physical mail etc. just in case.

    • EightImmortals on 02/12/2023 - 07:57

      Cheers, yeah it does feel a bit sus. Haven't had any unusually suspicious emails. Not sure who I would have pissed off 'that' much, the worst I do is disagree with folk on certain issues, wouldn't be enough to initiate a jihad? But who knows these days?

  • hazzad on 02/12/2023 - 09:03

    If you have two factor auth enabled you should be fine. I get several attempts to reset my Outlook accounts password a week. But because I have two factor enabled they can't get the verification code.

    • EightImmortals on 02/12/2023 - 09:28

      Thanks, yep have 2fa and strong passwords on most stuff.

Login or Join to leave a comment
Login Join