Someone accessed my facebook account internally?

Hyena

legendary

Activity: 2114

Merit: 1011

Quote from: vite on December 31, 2012, 10:22:49 AM

Do go to FB directly it will promp the security warning and that way you will be sure that you were not phished. Happened to me once but never emailed just blocked from the website

Yes that's what happened but I also got the e-mail. Later when I changed the password I got another e-mail notifying me that I have changed my password.

vite

legendary

Activity: 1018

Merit: 1000

Do go to FB directly it will promp the security warning and that way you will be sure that you were not phished. Happened to me once but never emailed just blocked from the website

Hyena

legendary

Activity: 2114

Merit: 1011

Also, this was the body of the message:

Code:

Your Facebook account was recently logged into from a computer, mobile device or
other location you've never used before. For your protection, we've temporarily
locked your account until you can review this activity and make sure no one is using
your account without your permission.

Did you log into Facebook from a new device or an unusual location?

 - If this was not you, please log into Facebook from your computer and follow the
instructions provided to help you control your account information. 

 - If this was you, there's no need to worry. Simply log into Facebook again to get
back into your account.

For more information, visit our Help Center here:
http://www.facebook.com/help/account_recovery

Thanks,
Facebook Security Team

The link you see down there was exactly where it pointed to and it is legit. I first received the notice when actually being on facebook watching some youtube video. I think it was not phishing. I also tried to access facebook by their IP but unfortunately none of the ones I found from the web worked so I had to rely on DNS. I don't think the DNS was compromised anyway.

Raoul Duke

legendary

Activity: 1358

Merit: 1002

Quote from: John (John K.) on December 31, 2012, 10:01:42 AM

Quote from: Hyena on December 31, 2012, 09:38:38 AM

Quote from: chmod755 on December 31, 2012, 09:03:37 AM

Quote from: Hyena on December 30, 2012, 09:24:01 PM

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

You're being monitored by several governments.

Quote from: odolvlobo on December 30, 2012, 11:07:30 PM

How did you receive the notice? Are you sure it was from Facebook? That type of phishing email is pretty common.

@ OP check the email headers...

Subject:     Did you log into Facebook from somewhere new?
From:     "Facebook"
Date:     Sun, December 30, 2012 1:13 am

Code:

Return-path: 
Envelope-to: [email protected]
Delivery-date: Sun, 30 Dec 2012 01:13:19 +0200
Received: from mail by s1-136.netpoint.ee with spam-scanned (Exim 4.72)
     (envelope-from )
     id 1Tp5ad-00010o-CQ
     for [email protected]; Sun, 30 Dec 2012 01:13:19 +0200
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on s1-136.netpoint.ee
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00,
     RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2
Received: from outmail018.snc4.facebook.com ([66.220.144.152] helo=mx-out.facebook.com)
     by s1-136.netpoint.ee with esmtp (Exim 4.72)
     (envelope-from )
     id 1Tp5ad-00010l-4b
     for [email protected]; Sun, 30 Dec 2012 01:13:15 +0200
DKIM-Signature: v=1; a=rsa-sha256; d=facebookmail.com; s=s1024-2011-q2; c=relaxed/simple;
     q=dns/txt; [email protected]; t=1356822793;
     h=From:Subject:Date:To:MIME-Version:Content-Type;
     bh=qCvLOkMCmrsevCXzRzwC0ULa6iLyXUg9bEzd37cis2A=;
     b=VZxlY/F0S2d3q6OyTx4WD7Hk+/Zz/utdiI2T9/BOt8MsL1dOVWvfQOnJVFUIHUGa
     871j7xUshrosWuLXr1lucS3L6IWO3wTZs8MA1DvtlPDVieJHADUK7Ja36ICfiqJI
     l9G2nmyoVV4dtBlMbrIg3mBNI/9kvwVZPFiMnKNwkk0=;
Received: from [10.80.169.69] ([10.80.169.69:57547])
     by smout023.snc6.facebook.com (envelope-from )
     (ecelerity 2.2.2.45 r(34222M)) with ECSTREAM
     id 28/A9-30137-9097FD05; Sat, 29 Dec 2012 15:13:13 -0800
X-Facebook: from zuckmail ([MTI3LjAuMC4x])
     by www.facebook.com with HTTP (ZuckMail);
Date: Sat, 29 Dec 2012 15:13:13 -0800
To: *********** 
From: "Facebook" 
Reply-to: noreply 
Subject: Did you log into Facebook from somewhere new?
Message-ID: 
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: [email protected]
X-Facebook-Notify: roadblock; mailid=7497637G5af37729d4c1G0G7b
X-FACEBOOK-PRIORITY: 0
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"

Seems legit. Although I'm not sure under what criteria.

However, it cointains similar IP that logged in to my account: "Received: from [10.80.169.69] ([10.80.169.69:57547])"

No, probably not legit.

http://www.hoax-slayer.com/facebook-secure-account-phishing-scam.shtml

I very much doubt the message is a phish. DKIM signatures aren't easy to fake.
Also, opening facebook straight on the browser would also show the user the same security warning. No need to follow the link on the emails.

Hyena

legendary

Activity: 2114

Merit: 1011

Oh shit. But the address bar was constantly facebook.com, how's that? I especially kept an eye on that.

John (John K.)

legendary

Activity: 1288

Merit: 1226

Away on an extended break

Quote from: Hyena on December 31, 2012, 09:38:38 AM

Quote from: chmod755 on December 31, 2012, 09:03:37 AM

Quote from: Hyena on December 30, 2012, 09:24:01 PM

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

You're being monitored by several governments.

Quote from: odolvlobo on December 30, 2012, 11:07:30 PM

How did you receive the notice? Are you sure it was from Facebook? That type of phishing email is pretty common.

@ OP check the email headers...

Subject:     Did you log into Facebook from somewhere new?
From:     "Facebook"
Date:     Sun, December 30, 2012 1:13 am

Code:

Return-path: 
Envelope-to: [email protected]
Delivery-date: Sun, 30 Dec 2012 01:13:19 +0200
Received: from mail by s1-136.netpoint.ee with spam-scanned (Exim 4.72)
     (envelope-from )
     id 1Tp5ad-00010o-CQ
     for [email protected]; Sun, 30 Dec 2012 01:13:19 +0200
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on s1-136.netpoint.ee
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00,
     RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2
Received: from outmail018.snc4.facebook.com ([66.220.144.152] helo=mx-out.facebook.com)
     by s1-136.netpoint.ee with esmtp (Exim 4.72)
     (envelope-from )
     id 1Tp5ad-00010l-4b
     for [email protected]; Sun, 30 Dec 2012 01:13:15 +0200
DKIM-Signature: v=1; a=rsa-sha256; d=facebookmail.com; s=s1024-2011-q2; c=relaxed/simple;
     q=dns/txt; [email protected]; t=1356822793;
     h=From:Subject:Date:To:MIME-Version:Content-Type;
     bh=qCvLOkMCmrsevCXzRzwC0ULa6iLyXUg9bEzd37cis2A=;
     b=VZxlY/F0S2d3q6OyTx4WD7Hk+/Zz/utdiI2T9/BOt8MsL1dOVWvfQOnJVFUIHUGa
     871j7xUshrosWuLXr1lucS3L6IWO3wTZs8MA1DvtlPDVieJHADUK7Ja36ICfiqJI
     l9G2nmyoVV4dtBlMbrIg3mBNI/9kvwVZPFiMnKNwkk0=;
Received: from [10.80.169.69] ([10.80.169.69:57547])
     by smout023.snc6.facebook.com (envelope-from )
     (ecelerity 2.2.2.45 r(34222M)) with ECSTREAM
     id 28/A9-30137-9097FD05; Sat, 29 Dec 2012 15:13:13 -0800
X-Facebook: from zuckmail ([MTI3LjAuMC4x])
     by www.facebook.com with HTTP (ZuckMail);
Date: Sat, 29 Dec 2012 15:13:13 -0800
To: *********** 
From: "Facebook" 
Reply-to: noreply 
Subject: Did you log into Facebook from somewhere new?
Message-ID: 
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: [email protected]
X-Facebook-Notify: roadblock; mailid=7497637G5af37729d4c1G0G7b
X-FACEBOOK-PRIORITY: 0
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"

Seems legit. Although I'm not sure under what criteria.

However, it cointains similar IP that logged in to my account: "Received: from [10.80.169.69] ([10.80.169.69:57547])"

No, probably not legit.

http://www.hoax-slayer.com/facebook-secure-account-phishing-scam.shtml

Hyena

legendary

Activity: 2114

Merit: 1011

Quote from: chmod755 on December 31, 2012, 09:03:37 AM

Quote from: Hyena on December 30, 2012, 09:24:01 PM

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

You're being monitored by several governments.

Quote from: odolvlobo on December 30, 2012, 11:07:30 PM

How did you receive the notice? Are you sure it was from Facebook? That type of phishing email is pretty common.

@ OP check the email headers...

Subject:     Did you log into Facebook from somewhere new?
From:     "Facebook"
Date:     Sun, December 30, 2012 1:13 am

Code:

Return-path: 
Envelope-to: [email protected]
Delivery-date: Sun, 30 Dec 2012 01:13:19 +0200
Received: from mail by s1-136.netpoint.ee with spam-scanned (Exim 4.72)
     (envelope-from )
     id 1Tp5ad-00010o-CQ
     for [email protected]; Sun, 30 Dec 2012 01:13:19 +0200
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on s1-136.netpoint.ee
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00,
     RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2
Received: from outmail018.snc4.facebook.com ([66.220.144.152] helo=mx-out.facebook.com)
     by s1-136.netpoint.ee with esmtp (Exim 4.72)
     (envelope-from )
     id 1Tp5ad-00010l-4b
     for [email protected]; Sun, 30 Dec 2012 01:13:15 +0200
DKIM-Signature: v=1; a=rsa-sha256; d=facebookmail.com; s=s1024-2011-q2; c=relaxed/simple;
     q=dns/txt; [email protected]; t=1356822793;
     h=From:Subject:Date:To:MIME-Version:Content-Type;
     bh=qCvLOkMCmrsevCXzRzwC0ULa6iLyXUg9bEzd37cis2A=;
     b=VZxlY/F0S2d3q6OyTx4WD7Hk+/Zz/utdiI2T9/BOt8MsL1dOVWvfQOnJVFUIHUGa
     871j7xUshrosWuLXr1lucS3L6IWO3wTZs8MA1DvtlPDVieJHADUK7Ja36ICfiqJI
     l9G2nmyoVV4dtBlMbrIg3mBNI/9kvwVZPFiMnKNwkk0=;
Received: from [10.80.169.69] ([10.80.169.69:57547])
     by smout023.snc6.facebook.com (envelope-from )
     (ecelerity 2.2.2.45 r(34222M)) with ECSTREAM
     id 28/A9-30137-9097FD05; Sat, 29 Dec 2012 15:13:13 -0800
X-Facebook: from zuckmail ([MTI3LjAuMC4x])
     by www.facebook.com with HTTP (ZuckMail);
Date: Sat, 29 Dec 2012 15:13:13 -0800
To: *********** 
From: "Facebook" 
Reply-to: noreply 
Subject: Did you log into Facebook from somewhere new?
Message-ID: 
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: [email protected]
X-Facebook-Notify: roadblock; mailid=7497637G5af37729d4c1G0G7b
X-FACEBOOK-PRIORITY: 0
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"

Seems legit. Although I'm not sure under what criteria.

However, it cointains similar IP that logged in to my account: "Received: from [10.80.169.69] ([10.80.169.69:57547])"

vite

legendary

Activity: 1018

Merit: 1000

I use Facebook hence I am not a geek.
I use facebook for casual chatting encounters.

chmod755

legendary

Activity: 1400

Merit: 1020

Quote from: Hyena on December 30, 2012, 09:24:01 PM

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

You're being monitored by several governments.

Quote from: odolvlobo on December 30, 2012, 11:07:30 PM

How did you receive the notice? Are you sure it was from Facebook? That type of phishing email is pretty common.

@ OP check the email headers...

Hyena

legendary

Activity: 2114

Merit: 1011

My facebook activity should not be a concern in my opinion, although I sometimes share videos from here: http://www.amtvmedia.com/

Plus I like bitcoin.

I thought about phishing too but I carefully looked at the address bar and it was valid. Also I am using pidgin facebook chat in parallel and the strange behaviour started several hours before the IP notice. My pidgin chat kept disconnecting and reconnecting for several hours. I always got the message "server has disconnected you because you were logged in from another device" (not exact wording).

When I tried to brute force my facebook from the TOR network I wasn't receiving that notice so I guess brute forcing doesn't trigger it. Also, I changed my password at facebook to really strong a couple of months ago. The password contains numbers, letters of different cases and also symbols, its length goes up to 20+ characters.

I use linux mint 14, firefox 17.0.1 and noscript is usually enabled. However, sometimes I have to disable it. I also have a theory that this was facebook's internal mess up. Maybe their main service didn't notice their chat.facebook.com service and because pidgin chat uses the same password it messed something up causing their internal ip to be blocked by their main service.

Because my passwords at different sites are somewhat similar I'm concerned that maybe I should change them all (which would be really unpleasant) but considering that it would kill the excess paranoia in me it would be a smart thing to do anyway.

By the way, because my general distrust in communication channels such as skype, MSN, facebook chat and even e-mail I developed my own communication channel that uses AES 256 encryption. It's here: http://ratchat.net.ee

Third Way

full member

Activity: 238

Merit: 100

I don't think it was an e-mail, I've had a similar spook with Gmail, where I am warned of some odd behavior with my account happened due to smeone trying to guess my pass from a place in China.

It could have been someone trying to brute force.

odolvlobo

legendary

Activity: 4298

Merit: 3209

Quote from: Hyena on December 30, 2012, 09:24:01 PM

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

How did you receive the notice? Are you sure it was from Facebook? That type of phishing email is pretty common.

Herodes

hero member

Activity: 868

Merit: 1000

Quote from: dree12 on December 30, 2012, 10:40:44 PM

Quote from: Herodes on December 30, 2012, 10:39:22 PM

Quote from: Hyena on December 30, 2012, 09:24:01 PM

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

Being on facebook means you're being surveiled, why did you think most geeks don't use facebook ?

Use DoNotTrackMe or a similar add-on. You choose your own level of surveillance.

So you think no law enforcement agencies use facebook data ?

adamstgBit

legendary

Activity: 1904

Merit: 1037

Trusted Bitcoiner

I'd recommend
http://www.thebitcoinreview.com/site.php?site_id=884

or look through the list of bitcoin VPNs
http://www.thebitcoinreview.com/search.php?search=VPN

dree12

legendary

Activity: 1246

Merit: 1076

Quote from: Herodes on December 30, 2012, 10:39:22 PM

Quote from: Hyena on December 30, 2012, 09:24:01 PM

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

Being on facebook means you're being surveiled, why did you think most geeks don't use facebook ?

Use DoNotTrackMe or a similar add-on. You choose your own level of surveillance.

Herodes

hero member

Activity: 868

Merit: 1000

Quote from: Hyena on December 30, 2012, 09:24:01 PM

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

Being on facebook means you're being surveiled, why did you think most geeks don't use facebook ?

dree12

legendary

Activity: 1246

Merit: 1076

Quote from: Hyena on December 30, 2012, 09:24:01 PM

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

Are you sure it was Facebook that asked you to change your password? Sounds like a classic phishing scam to me.

Third Way

full member

Activity: 238

Merit: 100

You probably posted some not very nice things about Jewish Merchant Overlord Zuckerberg, did you? Happened to me. Embarrassed

Hyena

legendary

Activity: 2114

Merit: 1011

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

Topic: Someone accessed my facebook account internally? (Read 2118 times)