Bitcoin Forum

Hello,

i received "Authorize log-in attempt" e-mail from blockchain and they says: "If this login attempt was not made by you it means someone visited your wallet login page from an unrecognised browser."

IP Address: TOR Hidden Service
Browser: Mozilla
User Agent: Mozilla/5.0

it was not me who tried to login, so it mean that

a) someone know my password

or

b) someone know or guessed my identifier

?

Thank you

Blockchain.info's wallet sends a login verification if the wallet identifier is correct, even if the password is wrong. Hence, if the email is authentic, someone has your identifier and potentially your password since the identifier is so long that I doubt anyone would be so dumb to bruteforce it. Have you leaked your identifier or email somewhere?

Check the email source and verify that it is from Blockchain.info. Check the bottom of the email and see if the identifier listed is correct.

I would guess someone has discovered your identifier in some way, and might be trying to bruteforce the wallet's password.

In the wallet's settings, you can block connections from TOR.

I got the same email, thank god that is my old wallet from 3 years ago but still scary knowing blockchain isn't secure

Someone knows your  identifier and trying to bruteforce the accounts password and it shows there that its using tor  service which i suspected  he used that  on purpose  so that he wont be  tracked afterall, as they say you can  go to settings and block the connections from tor.

Thx all for advices.

E-mail headers: Received: from o1.mail.blockchain.info (o1.mail.blockchain.info. [198.21.6.174])
So probably not fake..

Im almost sure i would not accidentally paste my identifier instead of my bitcoin wallet

I may have it noted in one of the apps on my lost Android phone.. + i have it on protectedtext.com

I just set secondary password which is requested always when sending money out.

It means that someone know your password because blockchain.info sends the email to authorize only when the other user know your identifier + password , if the combination is not there of both then the blockchain.info will not send you email to authorize.
PS: it is better that you change your password.

The sender IP is consistent with one of the login request I made.

Your Bitcoins should probably be safe since the attacker needs the email verification before he can log in. The security measures you have taken should be secure enough but I would still recommend you to shift the Bitcoins from Blockchain.info to a desktop wallet if you want to be more secure. Blockchain.info is still open to various attack vectors even with the verification.
Knowing the identifier is enough to trigger the email verification.

i don't think blockchain is joking with you if they are warning you then i will advice transfer your bitcoin to a new wallet somewhere new place like download a new wallet on your android and keep your coins there

definitely doesn't mean someone know your password but the hacker maybe knew your identifier so be careful,try to increase your security at this point atleast some sms authenticator and everything will be fine

i do not see how this makes blockchain insecure. they even send you a mail to inform you, which is another form of protection. maybe someone got your identifier and it could be your fault. i do not get it why you blame blockchain without hesitation.

Actually this doesn't show blockchain.info isn't secure its your responsibility to follow all necessary security precautions with your wallet login details.

Its not a good practice to save any important notes in apps/software/cloud storage service because those files may get compromised by those services. Good to know you have set secondary password and also don't forget to deny access from TOR from your wallet setting.

Make sure it isn't a spam email first, because unless you've posted you wallet ID (the long string of characters) somewhere I don't know how they would have access to it. Maybe they have access to your email account? Note the TOR service; if you can check for any recent activity with your email from weird IPs.

Assuming they didn't log in that's a good thing, but there is a function where you can turn any TOR's access to your wallet off. That could simply stop thi guy unless he wants to start masking his IP and exposing himself more.

Most likely he found your identifier somwhere and tried to log in , although there is no service or any site require you to submit your identifier , you must not share it , because it is the key of your wallet , if you didn't share it anywhere , check your computer with anti-malware , maybe your computer have a trojan or malicious software .

maybe you just getting trapped into a phising website,just for information that blockchain.info have so many clone website that had been created by hacker to steal your data,so beware,better to change your password right now,or atleast change your password periodically and be sure to not forget the pasword

If you take a look at this you will see it is not the real blockchain.info

http://ipinfo.elasticbeanstalk.com/198.21.6.174

But this is the real one.

http://w3bin.com/domain/blockchain.info

Yea, if they give you a Url to visit to check your security settings ... then the Alert bells should go off. The secondary password is of no use, if your wallet is compromised. The secondary password can

be changed, once they get access to your account. Did you enable 2FA on your account? It is always a good idea to use some form of encrypted email account and also to enable 2FA. I get notified,

when people access my account via any other destination other than the IP specified in the account.  ;)

The IP he provided was the SMTP server address and it can be different from their main website's address. Their main website address is also covered by cloudflare.

The IP corresponds to the email which I received. The email I received is confirmed to be from blockchain.info.

Thats strange any mail I get comes from a French IP

But check the ip out here http://anti-hacker-alliance.com/index.php?ip=198.21.6.174

Not sure about that, since even if the attacker had your identifier or even your password, Blockchain would prompt email authentication which isn't really something the hacker can simply get.

Better change your password OP. That's probably the only safest way you could do right now.

yes then he knows your identifier and pass so he insisted browser verification ..that good that you have this featured enabled and if you have google 2factor enabled then you have not iisue

Without reading the entire conversation in the tread,you might have been a victim of a phishing attack!Please do check in your mail if the login link to blokchain.info is provided,don't entire any credentials,just check the domain name and conform its the real one.Otherwise,as simple as it sounds,your acount is safe and someone is trying to steal your coins.Doubt blockchain.info sends any persnal emails like that...

This is not really blockchain mail!

Blockchain.info is actually sending this kind of emails on log in, but blockhain@info email, not 01.mail.blockchain.info
Did you click on link in that mail and give them your wallet ID and pass? This looks like phishing attack, make sure you change pass and set 2FA when using online wallets!