0

I just noticed some a suspicious login into my Gmail account. When I check my login history, I see one entry that looks like:

Access Type: Browser (Chrome)

"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36,gzip(gfe),gzip(gfe)"

(Browser, mobile, POP3, etc.) Location (IP address) United States (CO) (2601:283:c200:8782:8039:dc84:e32c:513a)

It appears to be a Windows 7 login, which I do not own. The IP address given is foreign to me and I don't know how to decode it. Does anyone know?

I would like to change my password, but I think it is someone stalking me (someone I am in legal issues with currently, so I want to find out if it is actually that person).

closed as off-topic by techraf, wireghoul, Steve, Xiong Chiamiov, Xander Feb 8 '17 at 21:01

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – techraf, wireghoul, Steve, Xiong Chiamiov, Xander
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What's preventing you from changing your password? What would knowing the IP address provide you? – schroeder Feb 8 '17 at 7:26
  • You could also try contacting Gmail support. – schroeder Feb 8 '17 at 7:27
  • Are you certain that is not your own IP address? – kasperd Feb 8 '17 at 9:50
5

There's nothing encoded in the log example, it's just a regular IPv6 address. According to db-ip.

2601:283:c200:8782:8039:dc84:e32c:513a is an IPv6 address owned by Comcast Cable Communications and located in Pueblo, United States

If you are in a legal dispute and suspect being a victim of stalking, you should cooperate with your local authorities.

  • Thank you. I contacted my local police and my attorney. This is extremely weird. I changed my password, and this person logged in again after I changed my password. If this person is the person I am in legal disputes with, who is not tech savvy at all, so I don't understand how they could have possibly logged in again afterwards. – David Feb 8 '17 at 6:14
  • I am actually using a university email that uses the gmail.com domain. My university does not currently allow two-step verification. Is there any way to check what this person may have been doing to my account? I suspect they are reading my emails to my attorney. – David Feb 8 '17 at 6:16
  • @David If it is a University account, then the University admins have access to your account. For legal matters, I'd highly suggest getting your own personal account. – schroeder Feb 8 '17 at 7:29
  • I'm not too familiar with university/gmail accounts - but how would the university admins have access? I'd say that would be a grave misconfiguration. I'd rather say, as it is a semi-public computer (?), that a keylogger or the like may be the tool to get access. How else has access to the device you used to change your password? – SaAtomic Feb 8 '17 at 7:40
  • 1
    @SaAtomic Not really - they're essentially corporate accounts. This is the same functionality that an Exchange administrator has in a Windows domain. I doubt that such access would leave traces as shown though - read my answer to security.stackexchange.com/questions/149511/… for some reasons why – Matthew Feb 8 '17 at 9:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.