Re: Recent Phishing Uptick

[Frank Barton <bartonf () HUSSON EDU>]

Thank you for the link/steps David. I was able to get in, and by using it
find out that one of our users that had their password compromised accounts
was logged into both from Nigeria and India.

I saw that some of these logins were flagged as suspicious. (I wish I knew
more about Google's definition of suspicious) but I got to thinking that it
would be relatively simple to write up something that checks using the API
on a regular basis, and checks unknown IP addresses against a geolocation
service (and that caches this geolocation data to save on future lookups).

before I start writing code, does anybody know if such a system already
exists?
what geolocation services have people used that they are happy with?

I'm thinking that we could flag logins from "known bad actors/countries"
and also use this as a way to retroactively look at an account that we
suspect of being compromised.

Thoughts?


-- 
Frank Barton
Apple Certified Mac Technician
Technology Support Coordinator
Husson University