Unauthorized access to my account on 11/4/22

[Sandy]

A device in Colorado accessed my Dropbox. I changed my password. 

Is it related to the phishing attack?  Can the IP address listed be used to identify the person, or report them?

Thanks

[Rich]

---

@Sandy wrote:

Is it related to the phishing attack?  Can the IP address listed be used to identify the person, or report them?

---

Any unauthorized access on any server could be related to a phishing attack. Have you clicked any links in email recently and entered your credentials as a result? If so, it could have been due to a phishing attack.

The IP address won't tell you anything useful. At most it will only tell you the owner of the IP range (the ISP, not the individual). It does nothing useful for location (my IP address shows a location on the opposite side of the state from where I really am) and it's easily faked (VPN services, etc.).

The best thing you can do is to first change your password, which you've done, and then verify there are no unknown devices or active web sessions listed on your Security page. If there are, remove them.

[Sandy · Accepted solution]

Thank you for the help, and the very quick reply.

In troubleshooting, I learned that it was my own phone using a remote IP. I had no idea that was possible. 

When I changed my password and unlinked the "suspicious" device, Dropbox then required a fresh login on my phone.

Now the same device is listed as linked, but with a local IP. Weird.

Thanks again.

[Rich]

---

@Sandy wrote:

In troubleshooting, I learned that it was my own phone using a remote IP. I had no idea that was possible.

---

Just goes to show how IP information is (mostly) useless. As another example, my phone's IP currently shows its location as New York City, and I'm about 4 hours away from New York.