Gmail warnin:we believe ur account was accessed from presidency.gov.lb

mir

So, it was 3AM - gmail was open and the alert goes on.

We believe your account was accessed from lebanon ( presidency.gov.lb )
attached is link to the print screen i shared on twitter

http://twitpic.com/3ijhg0

seriously dear govt ! too bad i wasn't sleeping, hein ? and sooo much for privacy.

Needless to say that i logged out all my session from google and changed the password to another strong one.

Georges

Someone will get arrested soon!
Yes Yes, you heard me !

nuclearcat

IMO this is not their ip address, i did PTR.
usa1 ~ # host 77.42.252.18
Host 18.252.42.77.in-addr.arpa. not found: 3(NXDOMAIN)

mir

nuc - gmail was already open for like 3 hours when the alert came on , so that rules out that my IP just got natted on to theirs, right ? and no router restart.

any possible explanation of this ?

was it a happy coincidence since in same day i posted this : http://goo.gl/ONM7s

proners

nuclearcat wroteIMO this is not their ip address, i did PTR.
usa1 ~ # host 77.42.252.18
Host 18.252.42.77.in-addr.arpa. not found: 3(NXDOMAIN)

i don't know how you did your search nuke.. but
http://tools.whois.net/whoisbyip/ definitely pointed to lebanon

belal

Holy shit!

The source said there is a department in the public prosecutor’s office dedicated to monitoring the media and internet for insults against the president.

This department is not unique. A few months ago, a Facebook user not living in Lebanon insulted a retired member of the army, a source familiar with the incident told NOW Lebanon on condition of anonymity for fear of retribution. Two people agreed with that assessment, posted follow-up comments and were soon being investigated by military intelligence, the source said.

http://www.nowlebanon.com/NewsArchiveDetails.aspx?ID=182239

talking about militarists.......this same person didn't give a flying fuck when my hometown Beirut was invaded and defamed back in 2008.
On a sidenote, i'm really starting to respect President Lahoud.

BashLogic

mir wrotenuc - gmail was already open for like 3 hours when the alert came on , so that rules out that my IP just got natted on to theirs, right ? and no router restart.

any possible explanation of this ?

was it a happy coincidence since in same day i posted this : http://goo.gl/ONM7s

I dub thee as: Mir-Asange

belal

Post daily mir so that we know when you get arrested :P

jsaade

How would they technically access your account?

mezin

Good work you pissed them off :)

nuclearcat

I am managing presidency.gov.lb, there is no Ogero IP's in this zone.
Thats why i think it is strange.
And this ip just from dynamic DSL pool.

hussam

ZeRaW wroteHow would they technically access your account?

Perhaps she is using OpenBSD :D :D

jajoja

mir contact google support for more details of the situation maybe gmail is wrong with that message ...

mir

i am 100% investigating all this before any further action akid.

it is just crazy time of year now with clients asking for reports at end of year - and i have to deliver.
So i will be checking everything out at night or ASAP

I'd appreciate if anyone can help by investigating or doing a research on how the gmail thing works

I really don't want it to be the leb gov in my gmail - but i don't want to deny a fact under my nose

hussam

Resolving the hostname can always be wrong. but it doesn mean someone logged into your gmail account from that IP.
some phone numbers and names below:

whois 77.42.252.18
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '77.42.252.0 - 77.42.252.255'

inetnum: 77.42.252.0 - 77.42.252.255
netname: Libteloccasional2
descr: Libtel occasional2
country: lb
admin-c: AD12345-TC
tech-c: NA12345-GS
status: Assigned PA
mnt-by: toufic-mnt
source: RIPE # Filtered

person: Toufic Chebaro
address: Mina El Hosn Beirut Lebanon
phone: +9611374610
nic-hdl: AD12345-TC
source: RIPE # Filtered

person: Gaby Smayra
address: Mina El Hosn Beirut Lebanon
phone: +9613081349
nic-hdl: NA12345-GS
source: RIPE # Filtered

% Information related to '77.42.252.0/24AS42020'

route: 77.42.252.0/24
descr: Libtel Occasional2
origin: AS42020
mnt-by: toufic-mnt
source: RIPE # Filtered

% Information related to '77.42.248.0/21AS42020'

route: 77.42.248.0/21
descr: Contains subnet for GGC
origin: AS42020
mnt-by: toufic-mnt
source: RIPE # Filtered

BashLogic

if you want a private mail account, why do you use gmail?

BashLogic

btw, ripe info is not necessarily correct!

mir

I am managing presidency.gov.lb, there is no Ogero IP's in this zone.

quoting someone who saw on blog :
o_O what a pwnage. reverse DNS resolution
when I do

$dig -x 77.42.252.18 I get mfares.ogero.gov.lb

this is about dig
http://linux.about.com/od/commands/l/blcmdl1_dig.htm

nuclearcat

It is SOA record, and this mfares - email of zone administrator
Actually they don't have PTR record for this IP. My guess it is just dynamic IP from pppoe pool, but i am not sure about that. Did you use at that time Ogero?

mir

my internet connection is from local guy in batroun taking from wise.