• Networking

  • Gmail warnin:we believe ur account was accessed from presidency.gov.lb

So, it was 3AM - gmail was open and the alert goes on.

We believe your account was accessed from lebanon ( presidency.gov.lb )
attached is link to the print screen i shared on twitter

http://twitpic.com/3ijhg0

seriously dear govt ! too bad i wasn't sleeping, hein ? and sooo much for privacy.

Needless to say that i logged out all my session from google and changed the password to another strong one.
Someone will get arrested soon!
Yes Yes, you heard me !
IMO this is not their ip address, i did PTR.
usa1 ~ # host 77.42.252.18
Host 18.252.42.77.in-addr.arpa. not found: 3(NXDOMAIN)
nuc - gmail was already open for like 3 hours when the alert came on , so that rules out that my IP just got natted on to theirs, right ? and no router restart.

any possible explanation of this ?

was it a happy coincidence since in same day i posted this : http://goo.gl/ONM7s
nuclearcat wroteIMO this is not their ip address, i did PTR.
usa1 ~ # host 77.42.252.18
Host 18.252.42.77.in-addr.arpa. not found: 3(NXDOMAIN)
i don't know how you did your search nuke.. but
http://tools.whois.net/whoisbyip/ definitely pointed to lebanon
Holy shit!
The source said there is a department in the public prosecutor’s office dedicated to monitoring the media and internet for insults against the president.

This department is not unique. A few months ago, a Facebook user not living in Lebanon insulted a retired member of the army, a source familiar with the incident told NOW Lebanon on condition of anonymity for fear of retribution. Two people agreed with that assessment, posted follow-up comments and were soon being investigated by military intelligence, the source said.


http://www.nowlebanon.com/NewsArchiveDetails.aspx?ID=182239
talking about militarists.......this same person didn't give a flying fuck when my hometown Beirut was invaded and defamed back in 2008.
On a sidenote, i'm really starting to respect President Lahoud.
mir wrotenuc - gmail was already open for like 3 hours when the alert came on , so that rules out that my IP just got natted on to theirs, right ? and no router restart.

any possible explanation of this ?

was it a happy coincidence since in same day i posted this : http://goo.gl/ONM7s
I dub thee as: Mir-Asange
Post daily mir so that we know when you get arrested :P
How would they technically access your account?
Good work you pissed them off :)
I am managing presidency.gov.lb, there is no Ogero IP's in this zone.
Thats why i think it is strange.
And this ip just from dynamic DSL pool.
ZeRaW wroteHow would they technically access your account?
Perhaps she is using OpenBSD :D :D
mir contact google support for more details of the situation maybe gmail is wrong with that message ...
i am 100% investigating all this before any further action akid.

it is just crazy time of year now with clients asking for reports at end of year - and i have to deliver.
So i will be checking everything out at night or ASAP

I'd appreciate if anyone can help by investigating or doing a research on how the gmail thing works

I really don't want it to be the leb gov in my gmail - but i don't want to deny a fact under my nose
Resolving the hostname can always be wrong. but it doesn mean someone logged into your gmail account from that IP.
some phone numbers and names below:

whois 77.42.252.18
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '77.42.252.0 - 77.42.252.255'

inetnum: 77.42.252.0 - 77.42.252.255
netname: Libteloccasional2
descr: Libtel occasional2
country: lb
admin-c: AD12345-TC
tech-c: NA12345-GS
status: Assigned PA
mnt-by: toufic-mnt
source: RIPE # Filtered

person: Toufic Chebaro
address: Mina El Hosn Beirut Lebanon
phone: +9611374610
nic-hdl: AD12345-TC
source: RIPE # Filtered

person: Gaby Smayra
address: Mina El Hosn Beirut Lebanon
phone: +9613081349
nic-hdl: NA12345-GS
source: RIPE # Filtered

% Information related to '77.42.252.0/24AS42020'

route: 77.42.252.0/24
descr: Libtel Occasional2
origin: AS42020
mnt-by: toufic-mnt
source: RIPE # Filtered

% Information related to '77.42.248.0/21AS42020'

route: 77.42.248.0/21
descr: Contains subnet for GGC
origin: AS42020
mnt-by: toufic-mnt
source: RIPE # Filtered
if you want a private mail account, why do you use gmail?
btw, ripe info is not necessarily correct!
I am managing presidency.gov.lb, there is no Ogero IP's in this zone.
quoting someone who saw on blog :
o_O what a pwnage. reverse DNS resolution
when I do

$dig -x 77.42.252.18 I get mfares.ogero.gov.lb

this is about dig
http://linux.about.com/od/commands/l/blcmdl1_dig.htm
It is SOA record, and this mfares - email of zone administrator
Actually they don't have PTR record for this IP. My guess it is just dynamic IP from pppoe pool, but i am not sure about that. Did you use at that time Ogero?
my internet connection is from local guy in batroun taking from wise.