Suspicious Login

Community Technical Support
1

Hey Everyone,

I just found some suspicious logins to my account with two ips: 77.123.51.191 and 188.162.86.228 Im not sure what to do…

2

As with anything like this, verify the security of everything you have and ensure you haven’t got viruses or keyloggers on your computer/device.

Change passwords, and update everything you can. 2FA is well advised.

4 Likes
3

What he said!!!

4

I’m starting to think once whoever has your account, you are screwed. I have 2FA, I’ve changed my passwords on multiple machines, changed my email passwords, run virus scans, yet somehow someone is still able to get into my account. I’m convinced at this point someone at Gaijin is allowing this. There is no way all this security is bypassed unless someone on the inside is letting it happen.

5

Nah - Contact Support
If you enable 2FA no one can login without your authenticator app. But of course, it could always be someone that you know and has access to your phone. Maybe a sibling? Friend? Parents?

6

Your terminal has been assimilated by the org

7

And yet, with 2FA, someone is able to bypass and get into my account. Always the same IP in Russia. And no, no one else has access to my phone and I live by myself.

Support has been useless. The same canned response by someone that obviously didn’t read the original ticket that was opened.

Once you’ve eliminated the impossible whatever remains, however improbable, must be the truth. I have no viruses, no keyloggers, passwords changed using other systems not on the same wifi network (and using a 20 character password generator, and same IP in Russia is doing it. Logic and evidence suggests an inside job.

8

I’m currently experiencing the same thing, even changed email binding to a completely different email account. Thought it solved my problems but after few weeks same suspicious belarusian IP (i’m based in Singapore & malaysia btw) is still able to login to the game client without any triggering of any 2FA.

I’ve also scanned my pc and checked my netstat logs and don’t see any traffic to suspicious IP.

Are you still experiencing the same issues?