Someone accessed my facebook account internally?

[Hyena]

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

[Third Way]

You probably posted some not very nice things about Jewish Merchant Overlord Zuckerberg, did you? Happened to me. 

[dree12]

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

Are you sure it was Facebook that asked you to change your password? Sounds like a classic phishing scam to me.

[Herodes]

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

Being on facebook means you're being surveiled, why did you think most geeks don't use facebook ?

[dree12]

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

Being on facebook means you're being surveiled, why did you think most geeks don't use facebook ?

Use DoNotTrackMe or a similar add-on. You choose your own level of surveillance.

[adamstgBit]

I'd recommend
http://www.thebitcoinreview.com/site.php?site_id=884

or look through the list of bitcoin VPNs
http://www.thebitcoinreview.com/search.php?search=VPN

[Herodes]

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

Being on facebook means you're being surveiled, why did you think most geeks don't use facebook ?

Use DoNotTrackMe or a similar add-on. You choose your own level of surveillance.

So you think no law enforcement agencies use facebook data ?

[odolvlobo]

Hi! Yesterday I received this notice that facebook has detected unusual IP accessing my account. I did not recognize it and therefore was asked to change my password. The strange thing about it was that the ip that had accessed my account did not display any location on map nor ISP name or anything. It was just an IP number.

The IP was something like that: 10.x.y.z I can't remember what the x y and z were but I guess it doesn't matter because IPs that start with the number 10 belong to the private network anyway. This means that my account was accessed from some facebook's internal servers?

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

Also, suggest me good bitcoin VPNs. Should I go for Air VPN?

How did you receive the notice? Are you sure it was from Facebook? That type of phishing email is pretty common.

[Third Way]

I don't think it was an e-mail, I've had a similar spook with Gmail, where I am warned of some odd behavior with my account happened due to smeone trying to guess my pass from a place in China.

It could have been someone trying to brute force.

[Hyena]

My facebook activity should not be a concern in my opinion, although I sometimes share videos from here: http://www.amtvmedia.com/

Plus I like bitcoin.

I thought about phishing too but I carefully looked at the address bar and it was valid. Also I am using pidgin facebook chat in parallel and the strange behaviour started several hours before the IP notice. My pidgin chat kept disconnecting and reconnecting for several hours. I always got the message "server has disconnected you because you were logged in from another device" (not exact wording).

When I tried to brute force my facebook from the TOR network I wasn't receiving that notice so I guess brute forcing doesn't trigger it. Also, I changed my password at facebook to really strong a couple of months ago. The password contains numbers, letters of different cases and also symbols, its length goes up to 20+ characters.

I use linux mint 14, firefox 17.0.1 and noscript is usually enabled. However, sometimes I have to disable it. I also have a theory that this was facebook's internal mess up. Maybe their main service didn't notice their chat.facebook.com service and because pidgin chat uses the same password it messed something up causing their internal ip to be blocked by their main service.

Because my passwords at different sites are somewhat similar I'm concerned that maybe I should change them all (which would be really unpleasant) but considering that it would kill the excess paranoia in me it would be a smart thing to do anyway.

By the way, because my general distrust in communication channels such as skype, MSN, facebook chat and even e-mail I developed my own communication channel that uses AES 256 encryption. It's here: http://ratchat.net.ee

[chmod755]

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

You're being monitored by several governments.

How did you receive the notice? Are you sure it was from Facebook? That type of phishing email is pretty common.

@ OP check the email headers...

[vite]

I use Facebook hence I am not a geek.
I use facebook for casual chatting encounters.

[Hyena]

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

You're being monitored by several governments.

How did you receive the notice? Are you sure it was from Facebook? That type of phishing email is pretty common.

@ OP check the email headers...

Subject:      Did you log into Facebook from somewhere new?
From:      "Facebook" <notification+zrdovgdhg6ve@facebookmail.com>
Date:      Sun, December 30, 2012 1:13 am

Code:

Return-path: <notification+zrdovgdhg6ve@facebookmail.com>
Envelope-to: hyena@hyena.net.ee
Delivery-date: Sun, 30 Dec 2012 01:13:19 +0200
Received: from mail by s1-136.netpoint.ee with spam-scanned (Exim 4.72)
     (envelope-from <notification+zrdovgdhg6ve@facebookmail.com>)
     id 1Tp5ad-00010o-CQ
     for hyena@hyena.net.ee; Sun, 30 Dec 2012 01:13:19 +0200
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on s1-136.netpoint.ee
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00,
     RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2
Received: from outmail018.snc4.facebook.com ([66.220.144.152] helo=mx-out.facebook.com)
     by s1-136.netpoint.ee with esmtp (Exim 4.72)
     (envelope-from <notification+zrdovgdhg6ve@facebookmail.com>)
     id 1Tp5ad-00010l-4b
     for hyena@hyena.net.ee; Sun, 30 Dec 2012 01:13:15 +0200
DKIM-Signature: v=1; a=rsa-sha256; d=facebookmail.com; s=s1024-2011-q2; c=relaxed/simple;
     q=dns/txt; i=@facebookmail.com; t=1356822793;
     h=From:Subject:Date:To:MIME-Version:Content-Type;
     bh=qCvLOkMCmrsevCXzRzwC0ULa6iLyXUg9bEzd37cis2A=;
     b=VZxlY/F0S2d3q6OyTx4WD7Hk+/Zz/utdiI2T9/BOt8MsL1dOVWvfQOnJVFUIHUGa
     871j7xUshrosWuLXr1lucS3L6IWO3wTZs8MA1DvtlPDVieJHADUK7Ja36ICfiqJI
     l9G2nmyoVV4dtBlMbrIg3mBNI/9kvwVZPFiMnKNwkk0=;
Received: from [10.80.169.69] ([10.80.169.69:57547])
     by smout023.snc6.facebook.com (envelope-from <notification+zrdovgdhg6ve@facebookmail.com>)
     (ecelerity 2.2.2.45 r(34222M)) with ECSTREAM
     id 28/A9-30137-9097FD05; Sat, 29 Dec 2012 15:13:13 -0800
X-Facebook: from zuckmail ([MTI3LjAuMC4x])
     by www.facebook.com with HTTP (ZuckMail);
Date: Sat, 29 Dec 2012 15:13:13 -0800
To: *********** <hyena@hyena.net.ee>
From: "Facebook" <notification+zrdovgdhg6ve@facebookmail.com>
Reply-to: noreply <noreply@facebookmail.com>
Subject: Did you log into Facebook from somewhere new?
Message-ID: <fed531ce07d2f8b93338bbdf37cb75d8@www.facebook.com>
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: notification+zrdovgdhg6ve@facebookmail.com
X-Facebook-Notify: roadblock; mailid=7497637G5af37729d4c1G0G7b
X-FACEBOOK-PRIORITY: 0
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"

Seems legit. Although I'm not sure under what criteria.

However, it cointains similar IP that logged in to my account: "Received: from [10.80.169.69] ([10.80.169.69:57547])"

[John (John K.)]

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

You're being monitored by several governments.

How did you receive the notice? Are you sure it was from Facebook? That type of phishing email is pretty common.

@ OP check the email headers...

Subject:      Did you log into Facebook from somewhere new?
From:      "Facebook" <notification+zrdovgdhg6ve@facebookmail.com>
Date:      Sun, December 30, 2012 1:13 am

Code:

Return-path: <notification+zrdovgdhg6ve@facebookmail.com>
Envelope-to: hyena@hyena.net.ee
Delivery-date: Sun, 30 Dec 2012 01:13:19 +0200
Received: from mail by s1-136.netpoint.ee with spam-scanned (Exim 4.72)
     (envelope-from <notification+zrdovgdhg6ve@facebookmail.com>)
     id 1Tp5ad-00010o-CQ
     for hyena@hyena.net.ee; Sun, 30 Dec 2012 01:13:19 +0200
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on s1-136.netpoint.ee
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00,
     RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2
Received: from outmail018.snc4.facebook.com ([66.220.144.152] helo=mx-out.facebook.com)
     by s1-136.netpoint.ee with esmtp (Exim 4.72)
     (envelope-from <notification+zrdovgdhg6ve@facebookmail.com>)
     id 1Tp5ad-00010l-4b
     for hyena@hyena.net.ee; Sun, 30 Dec 2012 01:13:15 +0200
DKIM-Signature: v=1; a=rsa-sha256; d=facebookmail.com; s=s1024-2011-q2; c=relaxed/simple;
     q=dns/txt; i=@facebookmail.com; t=1356822793;
     h=From:Subject:Date:To:MIME-Version:Content-Type;
     bh=qCvLOkMCmrsevCXzRzwC0ULa6iLyXUg9bEzd37cis2A=;
     b=VZxlY/F0S2d3q6OyTx4WD7Hk+/Zz/utdiI2T9/BOt8MsL1dOVWvfQOnJVFUIHUGa
     871j7xUshrosWuLXr1lucS3L6IWO3wTZs8MA1DvtlPDVieJHADUK7Ja36ICfiqJI
     l9G2nmyoVV4dtBlMbrIg3mBNI/9kvwVZPFiMnKNwkk0=;
Received: from [10.80.169.69] ([10.80.169.69:57547])
     by smout023.snc6.facebook.com (envelope-from <notification+zrdovgdhg6ve@facebookmail.com>)
     (ecelerity 2.2.2.45 r(34222M)) with ECSTREAM
     id 28/A9-30137-9097FD05; Sat, 29 Dec 2012 15:13:13 -0800
X-Facebook: from zuckmail ([MTI3LjAuMC4x])
     by www.facebook.com with HTTP (ZuckMail);
Date: Sat, 29 Dec 2012 15:13:13 -0800
To: *********** <hyena@hyena.net.ee>
From: "Facebook" <notification+zrdovgdhg6ve@facebookmail.com>
Reply-to: noreply <noreply@facebookmail.com>
Subject: Did you log into Facebook from somewhere new?
Message-ID: <fed531ce07d2f8b93338bbdf37cb75d8@www.facebook.com>
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: notification+zrdovgdhg6ve@facebookmail.com
X-Facebook-Notify: roadblock; mailid=7497637G5af37729d4c1G0G7b
X-FACEBOOK-PRIORITY: 0
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"

Seems legit. Although I'm not sure under what criteria.

However, it cointains similar IP that logged in to my account: "Received: from [10.80.169.69] ([10.80.169.69:57547])"

No, probably not legit.

http://www.hoax-slayer.com/facebook-secure-account-phishing-scam.shtml

[Hyena]

Oh shit. But the address bar was constantly facebook.com, how's that? I especially kept an eye on that.

[Raoul Duke]

Any suggestions? Am I being monitored by THE GOVERNMENT? (No kidding, this creeps me out and I'm considering starting to use VPN)

You're being monitored by several governments.

How did you receive the notice? Are you sure it was from Facebook? That type of phishing email is pretty common.

@ OP check the email headers...

Subject:      Did you log into Facebook from somewhere new?
From:      "Facebook" <notification+zrdovgdhg6ve@facebookmail.com>
Date:      Sun, December 30, 2012 1:13 am

Code:

Return-path: <notification+zrdovgdhg6ve@facebookmail.com>
Envelope-to: hyena@hyena.net.ee
Delivery-date: Sun, 30 Dec 2012 01:13:19 +0200
Received: from mail by s1-136.netpoint.ee with spam-scanned (Exim 4.72)
     (envelope-from <notification+zrdovgdhg6ve@facebookmail.com>)
     id 1Tp5ad-00010o-CQ
     for hyena@hyena.net.ee; Sun, 30 Dec 2012 01:13:19 +0200
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on s1-136.netpoint.ee
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00,
     RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2
Received: from outmail018.snc4.facebook.com ([66.220.144.152] helo=mx-out.facebook.com)
     by s1-136.netpoint.ee with esmtp (Exim 4.72)
     (envelope-from <notification+zrdovgdhg6ve@facebookmail.com>)
     id 1Tp5ad-00010l-4b
     for hyena@hyena.net.ee; Sun, 30 Dec 2012 01:13:15 +0200
DKIM-Signature: v=1; a=rsa-sha256; d=facebookmail.com; s=s1024-2011-q2; c=relaxed/simple;
     q=dns/txt; i=@facebookmail.com; t=1356822793;
     h=From:Subject:Date:To:MIME-Version:Content-Type;
     bh=qCvLOkMCmrsevCXzRzwC0ULa6iLyXUg9bEzd37cis2A=;
     b=VZxlY/F0S2d3q6OyTx4WD7Hk+/Zz/utdiI2T9/BOt8MsL1dOVWvfQOnJVFUIHUGa
     871j7xUshrosWuLXr1lucS3L6IWO3wTZs8MA1DvtlPDVieJHADUK7Ja36ICfiqJI
     l9G2nmyoVV4dtBlMbrIg3mBNI/9kvwVZPFiMnKNwkk0=;
Received: from [10.80.169.69] ([10.80.169.69:57547])
     by smout023.snc6.facebook.com (envelope-from <notification+zrdovgdhg6ve@facebookmail.com>)
     (ecelerity 2.2.2.45 r(34222M)) with ECSTREAM
     id 28/A9-30137-9097FD05; Sat, 29 Dec 2012 15:13:13 -0800
X-Facebook: from zuckmail ([MTI3LjAuMC4x])
     by www.facebook.com with HTTP (ZuckMail);
Date: Sat, 29 Dec 2012 15:13:13 -0800
To: *********** <hyena@hyena.net.ee>
From: "Facebook" <notification+zrdovgdhg6ve@facebookmail.com>
Reply-to: noreply <noreply@facebookmail.com>
Subject: Did you log into Facebook from somewhere new?
Message-ID: <fed531ce07d2f8b93338bbdf37cb75d8@www.facebook.com>
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: notification+zrdovgdhg6ve@facebookmail.com
X-Facebook-Notify: roadblock; mailid=7497637G5af37729d4c1G0G7b
X-FACEBOOK-PRIORITY: 0
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"

Seems legit. Although I'm not sure under what criteria.

However, it cointains similar IP that logged in to my account: "Received: from [10.80.169.69] ([10.80.169.69:57547])"

No, probably not legit.

http://www.hoax-slayer.com/facebook-secure-account-phishing-scam.shtml

I very much doubt the message is a phish. DKIM signatures aren't easy to fake.
Also, opening facebook straight on the browser would also show the user the same security warning. No need to follow the link on the emails.

[Hyena]

Also, this was the body of the message:

Code:

Your Facebook account was recently logged into from a computer, mobile device or
other location you've never used before. For your protection, we've temporarily
locked your account until you can review this activity and make sure no one is using
your account without your permission.

Did you log into Facebook from a new device or an unusual location?

 - If this was not you, please log into Facebook from your computer and follow the
instructions provided to help you control your account information. 

 - If this was you, there's no need to worry. Simply log into Facebook again to get
back into your account.

For more information, visit our Help Center here:
http://www.facebook.com/help/account_recovery

Thanks,
Facebook Security Team

The link you see down there was exactly where it pointed to and it is legit. I first received the notice when actually being on facebook watching some youtube video. I think it was not phishing. I also tried to access facebook by their IP but unfortunately none of the ones  I found from the web worked so I had to rely on DNS. I don't think the DNS was compromised anyway.

[vite]

Do go to FB directly it will promp the security warning and that way you will be sure that you were not phished. Happened to me once but never emailed just blocked from the website

[Hyena]

Do go to FB directly it will promp the security warning and that way you will be sure that you were not phished. Happened to me once but never emailed just blocked from the website

Yes that's what happened but I also got the e-mail. Later when I changed the password I got another e-mail notifying me that I have changed my password.