EmailDiscussions.com

EmailDiscussions.com (http://www.emaildiscussions.com/index.php)
-   FastMail Forum (http://www.emaildiscussions.com/forumdisplay.php?f=27)
-   -   Help identifying unexpected login attempts (http://www.emaildiscussions.com/showthread.php?t=73089)

fmail_fan 26 Sep 2017 10:23 PM

Help identifying unexpected login attempts
 
By chance I noticed unexpected logins in my FastMail login log last evening. They were done over three days and were via my IMAP app password. I believe they are from an Android email app I briefly tried and uninstalled on 22-Sep. Checking the IP shows Amazon.com (Ashburn, VA), a common cloud storage service used by many such applications.

The app password was deleted and I'm now back to using the FM app. I've had three failed login attempts from different (Amazon) IPs since last evening. Although the logins are now prevented, is there a way to track down the source of these logins?

misc 26 Sep 2017 10:47 PM

It's possible that the email app you tried uses AWS to pull mails from all your accounts and collets them on it's own cloud. So actually not the app communicates with FastMail but the app's cloud server (hosted at Amazon) does. And the server is probably not aware that you've deleted your app and keeps on checking your mail at FM.

So I guess you should better have removed the FM account inside your mail app before deleting it. Not sure how to solve this. :confused: At least you can try installing the app again, then add your FM account and remove it again.

Cheers,
Michael

fmail_fan 26 Sep 2017 11:20 PM

Quote:

Originally Posted by misc (Post 604043)
It's possible that the email app you tried uses AWS to pull mails from all your accounts and collets them on it's own cloud. So actually not the app communicates with FastMail but the app's cloud server (hosted at Amazon) does. And the server is probably not aware that you've deleted your app and keeps on checking your mail at FM.

So I guess you should better have removed the FM account inside your mail app before deleting it. Not sure how to solve this. :confused: At least you can try installing the app again, then add your FM account and remove it again.

Cheers,
Michael

Yes, I agree. It's not the app (uninstalled) or some remnant that was left behind but cloud-to-cloud communication that's doing the logins. They will fail so the security issue is solved. I'm pretty sure of the app causing the issue; I'd just like to find a way to prove it. And I'd prefer not to install it again.


All times are GMT +9. The time now is 07:23 PM.


Copyright EmailDiscussions.com 1998-2013. All Rights Reserved. Privacy Policy