CINXE.COM
Hacked email account - Security - Spiceworks Community
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Hacked email account - Security - Spiceworks Community</title> <meta name="description" content="hi dears i have a domain hosted on (IPOWER) and unfortunately one of my employees email accounts had been hacked. we’ve changed the password but after 2 days the hacker sent another email using the same email address. &hellip;"> <meta name="generator" content="Discourse 3.4.0.beta3-dev - https://github.com/discourse/discourse version b9838d606633453b9fb27c90ee98d8a48bb1b8dd"> <link rel="icon" type="image/png" href="https://global.discourse-cdn.com/spiceworks/optimized/1X/a254df83358a951c43ed6ee756b5e0011a8d58bc_2_32x32.png"> <link rel="apple-touch-icon" type="image/png" href="https://global.discourse-cdn.com/spiceworks/optimized/1X/7a73606d7df2f794c4789897e49693fb3c471b23_2_180x180.png"> <meta name="theme-color" media="(prefers-color-scheme: light)" content="#ffffff"> <meta name="theme-color" media="(prefers-color-scheme: dark)" content="#080809"> <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, user-scalable=yes, viewport-fit=cover"> <link rel="canonical" href="https://community.spiceworks.com/t/hacked-email-account/1145637" /> <link rel="search" type="application/opensearchdescription+xml" href="https://community.spiceworks.com/opensearch.xml" title="Spiceworks Community Search"> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/color_definitions_spiceworks-light_9_30_3dcf9a68f45b4bc7a3b721d859dc1d9bc99a8ffb.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" class="light-scheme"/><link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/color_definitions_dark_1_30_c95e38a788cfef0b3400133edabe3ff42a2a54a8.css?__ws=community.spiceworks.com" media="(prefers-color-scheme: dark)" rel="stylesheet" class="dark-scheme"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/automation_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="automation" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/chat_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="chat" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/checklist_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="checklist" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-ai_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-ai" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-akismet_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-akismet" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-bbcode_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-bbcode" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-cakeday_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-cakeday" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-calendar_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-calendar" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-data-explorer_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-data-explorer" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-details_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-details" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-follow_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-follow" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-gamification_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-gamification" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-lazy-videos_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-lazy-videos" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-livestream_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-livestream" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-local-dates_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-local-dates" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-narrative-bot_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-narrative-bot" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-presence_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-presence" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-rss-polling_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-rss-polling" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-saved-searches_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-saved-searches" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-solved_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-solved" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-spiceworks-ads_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-spiceworks-ads" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-templates_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-templates" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-user-notes_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-user-notes" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/footnote_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="footnote" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/hosted-site_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="hosted-site" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/poll_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="poll" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/spoiler-alert_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="spoiler-alert" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/chat_desktop_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="chat_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-ai_desktop_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-ai_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-calendar_desktop_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-calendar_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-gamification_desktop_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-gamification_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/discourse-livestream_desktop_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="discourse-livestream_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/poll_desktop_14e0da26faf8c81633fdfbba3addb18a9c253cbc.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="poll_desktop" /> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_24_c0265d6a804402239c1e66868617c18269ec53b1.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="24" data-theme-name="category headers theme component"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_35_81a515fa8f2732c33d2a5a32c28267e8851a1a8b.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="35" data-theme-name="category icons"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_29_a2779232590c2b0ae17acbd5d346ac28d8e04470.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="29" data-theme-name="custom spiceworks"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_7_eefd4884cb37cc731a471fd5ae58eecbe910cb9f.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="7" data-theme-name="dropdown header - spiceworks edition"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_25_1fab3e132e4b1ea6760fad462810b7380f9e68be.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="25" data-theme-name="featured posts"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_37_b6906d3d800cb3f9b5fd69840e4589895ff24f87.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="37" data-theme-name="follow category button"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_33_ccbaabc353ba3695b933f47605a429017b007ef9.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="33" data-theme-name="guest gate theme component"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_27_94ad61e83368771bf459a3fe25f04e1425cf587c.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="27" data-theme-name="spiceworks footer"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_32_38c12bee9c1a7c4438a8d8ac738ecd9229695f21.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="32" data-theme-name="sw daily challenge"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_26_fffd0f91cb7fd6d9b97e59d834c7daee02fd3b75.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="26" data-theme-name="sw discourse profile page custom links"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_21_4a5911bea42a59f4835e0c5bfca3a57cf6d8b027.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="21" data-theme-name="sw promotions"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_28_d186a00588f5621cc71b55238ee42072a813205d.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="28" data-theme-name="sw user title and color for user groups"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_23_5a00a2f0712084b60216c8e1ef0f0f18b9bd1013.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="23" data-theme-name="sw-right-sidebar"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_20_caf1de789b46d3634fe02044d215aeec6d94d60b.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="20" data-theme-name="tag banners"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_34_47aca4f23b9fdf0646a200be53fc82a047c5b021.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="34" data-theme-name="tag icons"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_30_0e11ac7aff21135882327202b4cbd3fa5816aec5.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="30" data-theme-name="spiceworks (production)"/> <link href="https://sea3.discourse-cdn.com/spiceworks/stylesheets/desktop_theme_39_aa7ead72afb6bb17194851c252cf2dd0f57fc24f.css?__ws=community.spiceworks.com" media="all" rel="stylesheet" data-target="desktop_theme" data-theme-id="39" data-theme-name="livestream-ads"/> <!-- Google Tag Manager --> <!-- End Google Tag Manager --> <link rel="preload" href="https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js" as="script"><script defer="" src="https://sea3.discourse-cdn.com/spiceworks/theme-javascripts/5056370bc31bf58348723fbcbb56f3c7b8b1123e.js?__ws=community.spiceworks.com" data-theme-id="29" nonce="hXsi31Xq357zW9ktnmu8CK4YL"></script> <script defer="" src="https://sea3.discourse-cdn.com/spiceworks/theme-javascripts/96bd4879f7e2a5d38864677369649e8128ecea7c.js?__ws=community.spiceworks.com" data-theme-id="38" nonce="hXsi31Xq357zW9ktnmu8CK4YL"></script> <link rel="alternate nofollow" type="application/rss+xml" title="RSS feed of 'Hacked email account'" href="https://community.spiceworks.com/t/hacked-email-account/1145637.rss" /> <meta property="og:site_name" content="Spiceworks Community" /> <meta property="og:type" content="website" /> <meta name="twitter:card" content="summary" /> <meta name="twitter:image" content="https://global.discourse-cdn.com/spiceworks/original/1X/7a73606d7df2f794c4789897e49693fb3c471b23.png" /> <meta property="og:image" content="https://global.discourse-cdn.com/spiceworks/original/1X/7a73606d7df2f794c4789897e49693fb3c471b23.png" /> <meta property="og:url" content="https://community.spiceworks.com/t/hacked-email-account/1145637" /> <meta name="twitter:url" content="https://community.spiceworks.com/t/hacked-email-account/1145637" /> <meta property="og:title" content="Hacked email account" /> <meta name="twitter:title" content="Hacked email account" /> <meta property="og:description" content="hi dears i have a domain hosted on (IPOWER) and unfortunately one of my employees email accounts had been hacked. we’ve changed the password but after 2 days the hacker sent another email using the same email address. i contacted the IPOWER support team but they could not help. no 2FA and no logging out from all session feature available. could you please advice." /> <meta name="twitter:description" content="hi dears i have a domain hosted on (IPOWER) and unfortunately one of my employees email accounts had been hacked. we’ve changed the password but after 2 days the hacker sent another email using the same email address. i contacted the IPOWER support team but they could not help. no 2FA and no logging out from all session feature available. could you please advice." /> <meta property="og:article:section" content="Security" /> <meta property="og:article:section:color" content="0088CC" /> <meta property="og:article:tag" content="cyber-security" /> <meta property="og:article:tag" content="general-it-security" /> <meta property="og:article:tag" content="question" /> <meta name="twitter:label1" value="Reading time" /> <meta name="twitter:data1" value="1 mins 🕑" /> <meta name="twitter:label2" value="Spice ups" /> <meta name="twitter:data2" value="6 ❤" /> <meta property="article:published_time" content="2024-11-23T12:40:31+00:00" /> <meta property="og:ignore_canonical" content="true" /> <script type="application/ld+json">{"@context":"http://schema.org","@type":"QAPage","mainEntity":{"@type":"Question","name":"Hacked email account","text":"<p>hi dears<br>\ni have a domain hosted on (IPOWER) and unfortunately one of my employees email accounts had been hacked.<\/p>\n<p>we’ve changed the password but after 2 days the hacker sent another email using the same email address.<\/p>\n<p>i contacted the IPOWER support team but they could not help.<\/p>\n<p>no 2FA and no logging out from all session feature available.<\/p>\n<p>could you please advice.<\/p>","upvoteCount":0,"answerCount":4,"datePublished":"2024-11-23T12:40:31.482Z","author":{"@type":"Person","name":"spiceuser-mvhw","url":"https://community.spiceworks.com/u/spiceuser-mvhw"},"suggestedAnswer":[{"@type":"Answer","text":"<p>hi dears<br>\ni have a domain hosted on (IPOWER) and unfortunately one of my employees email accounts had been hacked.<\/p>\n<p>we’ve changed the password but after 2 days the hacker sent another email using the same email address.<\/p>\n<p>i contacted the IPOWER support team but they could not help.<\/p>\n<p>no 2FA and no logging out from all session feature available.<\/p>\n<p>could you please advice.<\/p>","upvoteCount":0,"datePublished":"2024-11-23T12:40:31.596Z","url":"https://community.spiceworks.com/t/hacked-email-account/1145637/1","author":{"@type":"Person","name":"spiceuser-mvhw","url":"https://community.spiceworks.com/u/spiceuser-mvhw"}},{"@type":"Answer","text":"<p>Disable their account first.<\/p>\n<p>Then go in to their mailbox and confirm there are no rules set to send out emails or replies.<\/p>\n<p>If this hoster does not support MFA of some kind, I’d suggest moving your emails elsewhere.<\/p>","upvoteCount":4,"datePublished":"2024-11-23T12:57:25.555Z","url":"https://community.spiceworks.com/t/hacked-email-account/1145637/2","author":{"@type":"Person","name":"Rod-IT","url":"https://community.spiceworks.com/u/Rod-IT"}},{"@type":"Answer","text":"<aside class=\"quote no-group\" data-username=\"spiceuser-mvhw\" data-post=\"1\" data-topic=\"1145637\" data-full=\"true\">\n<div class=\"title\">\n<div class=\"quote-controls\"><\/div>\n<img loading=\"lazy\" alt=\"\" width=\"24\" height=\"24\" src=\"https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/48.png\" class=\"avatar\"> spiceuser-mvhw:<\/div>\n<blockquote>\n<p>hi dears<br>\ni have a domain hosted on (IPOWER) and unfortunately one of my employees email accounts had been hacked.<\/p>\n<p>we’ve changed the password but after 2 days the hacker sent another email using the same email address.<\/p>\n<p>i contacted the IPOWER support team but they could not help.<\/p>\n<p>no 2FA and no logging out from all session feature available.<\/p>\n<p>could you please advice.<\/p>\n<\/blockquote>\n<\/aside>\n<p>can you first confirm if email account was “hacked” by looking if emails are in sent folder and the admin can see if emails were being actually sent by the email account.<\/p>\n<p>coz there can also be spoofing or that someone is using email relays and “send as” ?<\/p>\n<p>lastly, maybe move emails to a more secure SAAS like Exchange online or Gmail ?<\/p>","upvoteCount":1,"datePublished":"2024-11-24T08:33:33.109Z","url":"https://community.spiceworks.com/t/hacked-email-account/1145637/3","author":{"@type":"Person","name":"adrian_ych","url":"https://community.spiceworks.com/u/adrian_ych"}},{"@type":"Answer","text":"<p>Yes, please confirm whether the account is actually compromised, and email is going out of your servers (there will be logs), or whether they are able to spoof or impersonate your employee from an open relay or other email server because you don’t have SPF/DKIM/DMARC sufficiently locked down.<\/p>\n<p>If you can’t secure email with MFA, you really need to find another provider. This is exactly why it’s needed - even with the password a bad actor wouldn’t be able to get in without the MFA (unless they’ve completely compromised the device and are able to steal tokens).<\/p>","upvoteCount":1,"datePublished":"2024-11-25T15:56:04.110Z","url":"https://community.spiceworks.com/t/hacked-email-account/1145637/4","author":{"@type":"Person","name":"phildrew","url":"https://community.spiceworks.com/u/phildrew"}}]}}</script><script type="application/ld+json">[{"@context":"http://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":"https://community.spiceworks.com/c/security/28","name":"Security"},{"@type":"ListItem","position":2,"item":"https://community.spiceworks.com/tag/general-it-security","name":"general-it-security"},{"@type":"ListItem","position":3,"item":"https://community.spiceworks.com/t/hacked-email-account/1145637","name":"Hacked email account"}]},{"@context":"http://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":"https://community.spiceworks.com/c/security/28","name":"Security"},{"@type":"ListItem","position":2,"item":"https://community.spiceworks.com/tag/cyber-security","name":"cyber-security"},{"@type":"ListItem","position":3,"item":"https://community.spiceworks.com/t/hacked-email-account/1145637","name":"Hacked email account"}]},{"@context":"http://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":"https://community.spiceworks.com/c/security/28","name":"Security"},{"@type":"ListItem","position":2,"item":"https://community.spiceworks.com/tag/question","name":"question"},{"@type":"ListItem","position":3,"item":"https://community.spiceworks.com/t/hacked-email-account/1145637","name":"Hacked email account"}]}]</script> </head> <body class="crawler browser-update"> <script defer="" src="https://sea3.discourse-cdn.com/spiceworks/theme-javascripts/01223c6d02b16adad7d31f26ce4c503435f7656e.js?__ws=community.spiceworks.com" data-theme-id="24" nonce="hXsi31Xq357zW9ktnmu8CK4YL"></script> <header> <a href="/"> Spiceworks Community </a> </header> <div id="main-outlet" class="wrap" role="main"> <div id="topic-title"> <h1> <a href="/t/hacked-email-account/1145637">Hacked email account</a> </h1> <div class="topic-category" itemscope itemtype="http://schema.org/BreadcrumbList"> <span itemprop="itemListElement" itemscope itemtype="http://schema.org/ListItem"> <a href="/c/security/28" class="badge-wrapper bullet" itemprop="item"> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name' itemprop='name'>Security</span> </span> </a> <meta itemprop="position" content="1" /> </span> </div> <div class="topic-category"> <div class='discourse-tags list-tags'> <a href='https://community.spiceworks.com/tag/cyber-security' class='discourse-tag' rel="tag">cyber-security</a>, <a href='https://community.spiceworks.com/tag/general-it-security' class='discourse-tag' rel="tag">general-it-security</a>, <a href='https://community.spiceworks.com/tag/question' class='discourse-tag' rel="tag">question</a> </div> </div> </div> <div itemscope itemtype='http://schema.org/DiscussionForumPosting'> <meta itemprop='headline' content='Hacked email account'> <link itemprop='url' href='https://community.spiceworks.com/t/hacked-email-account/1145637'> <meta itemprop='datePublished' content='2024-11-23T12:40:31Z'> <meta itemprop='articleSection' content='Security'> <meta itemprop='keywords' content='cyber-security, general-it-security, question'> <div itemprop='publisher' itemscope itemtype="http://schema.org/Organization"> <meta itemprop='name' content='Spiceworks Inc.'> <div itemprop='logo' itemscope itemtype="http://schema.org/ImageObject"> <meta itemprop='url' content='https://global.discourse-cdn.com/spiceworks/original/4X/a/6/b/a6bdb5fb57f6080b918e219f9f8f79bfbbefa176.svg'> </div> </div> <div id='post_1' class='topic-body crawler-post'> <div class='crawler-post-meta'> <span class="creator" itemprop="author" itemscope itemtype="http://schema.org/Person"> <a itemprop="url" href='https://community.spiceworks.com/u/spiceuser-mvhw'><span itemprop='name'>spiceuser-mvhw</span></a> (spiceuser-mvhw) </span> <link itemprop="mainEntityOfPage" href="https://community.spiceworks.com/t/hacked-email-account/1145637"> <span class="crawler-post-infos"> <time datetime='2024-11-23T12:40:31Z' class='post-time'> November 23, 2024, 12:40pm </time> <meta itemprop='dateModified' content='2024-11-23T20:25:21Z'> <span itemprop='position'>1</span> </span> </div> <div class='post' itemprop='text'> <p>hi dears<br> i have a domain hosted on (IPOWER) and unfortunately one of my employees email accounts had been hacked.</p> <p>we’ve changed the password but after 2 days the hacker sent another email using the same email address.</p> <p>i contacted the IPOWER support team but they could not help.</p> <p>no 2FA and no logging out from all session feature available.</p> <p>could you please advice.</p> </div> <div itemprop="interactionStatistic" itemscope itemtype="http://schema.org/InteractionCounter"> <meta itemprop="interactionType" content="http://schema.org/LikeAction"/> <meta itemprop="userInteractionCount" content="0" /> <span class='post-likes'></span> </div> </div> <div id='post_2' itemprop='comment' itemscope itemtype='http://schema.org/Comment' class='topic-body crawler-post'> <div class='crawler-post-meta'> <span class="creator" itemprop="author" itemscope itemtype="http://schema.org/Person"> <a itemprop="url" href='https://community.spiceworks.com/u/Rod-IT'><span itemprop='name'>Rod-IT</span></a> (Rod-IT) </span> <span class="crawler-post-infos"> <time itemprop='datePublished' datetime='2024-11-23T12:57:25Z' class='post-time'> November 23, 2024, 12:57pm </time> <meta itemprop='dateModified' content='2024-11-23T12:57:25Z'> <span itemprop='position'>2</span> </span> </div> <div class='post' itemprop='text'> <p>Disable their account first.</p> <p>Then go in to their mailbox and confirm there are no rules set to send out emails or replies.</p> <p>If this hoster does not support MFA of some kind, I’d suggest moving your emails elsewhere.</p> </div> <div itemprop="interactionStatistic" itemscope itemtype="http://schema.org/InteractionCounter"> <meta itemprop="interactionType" content="http://schema.org/LikeAction"/> <meta itemprop="userInteractionCount" content="4" /> <span class='post-likes'>4 Spice ups</span> </div> </div> <div id='post_3' itemprop='comment' itemscope itemtype='http://schema.org/Comment' class='topic-body crawler-post'> <div class='crawler-post-meta'> <span class="creator" itemprop="author" itemscope itemtype="http://schema.org/Person"> <a itemprop="url" href='https://community.spiceworks.com/u/adrian_ych'><span itemprop='name'>adrian_ych</span></a> (adrian_ych) </span> <span class="crawler-post-infos"> <time itemprop='datePublished' datetime='2024-11-24T08:33:33Z' class='post-time'> November 24, 2024, 8:33am </time> <meta itemprop='dateModified' content='2024-11-24T08:33:33Z'> <span itemprop='position'>3</span> </span> </div> <div class='post' itemprop='text'> <aside class="quote no-group" data-username="spiceuser-mvhw" data-post="1" data-topic="1145637" data-full="true"> <div class="title"> <div class="quote-controls"></div> <img loading="lazy" alt="" width="24" height="24" src="https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/48.png" class="avatar"> spiceuser-mvhw:</div> <blockquote> <p>hi dears<br> i have a domain hosted on (IPOWER) and unfortunately one of my employees email accounts had been hacked.</p> <p>we’ve changed the password but after 2 days the hacker sent another email using the same email address.</p> <p>i contacted the IPOWER support team but they could not help.</p> <p>no 2FA and no logging out from all session feature available.</p> <p>could you please advice.</p> </blockquote> </aside> <p>can you first confirm if email account was “hacked” by looking if emails are in sent folder and the admin can see if emails were being actually sent by the email account.</p> <p>coz there can also be spoofing or that someone is using email relays and “send as” ?</p> <p>lastly, maybe move emails to a more secure SAAS like Exchange online or Gmail ?</p> </div> <div itemprop="interactionStatistic" itemscope itemtype="http://schema.org/InteractionCounter"> <meta itemprop="interactionType" content="http://schema.org/LikeAction"/> <meta itemprop="userInteractionCount" content="1" /> <span class='post-likes'>1 Spice up</span> </div> </div> <div id='post_4' itemprop='comment' itemscope itemtype='http://schema.org/Comment' class='topic-body crawler-post'> <div class='crawler-post-meta'> <span class="creator" itemprop="author" itemscope itemtype="http://schema.org/Person"> <a itemprop="url" href='https://community.spiceworks.com/u/phildrew'><span itemprop='name'>phildrew</span></a> (phildrew) </span> <span class="crawler-post-infos"> <time itemprop='datePublished' datetime='2024-11-25T15:56:04Z' class='post-time'> November 25, 2024, 3:56pm </time> <meta itemprop='dateModified' content='2024-11-25T15:56:04Z'> <span itemprop='position'>4</span> </span> </div> <div class='post' itemprop='text'> <p>Yes, please confirm whether the account is actually compromised, and email is going out of your servers (there will be logs), or whether they are able to spoof or impersonate your employee from an open relay or other email server because you don’t have SPF/DKIM/DMARC sufficiently locked down.</p> <p>If you can’t secure email with MFA, you really need to find another provider. This is exactly why it’s needed - even with the password a bad actor wouldn’t be able to get in without the MFA (unless they’ve completely compromised the device and are able to steal tokens).</p> </div> <div itemprop="interactionStatistic" itemscope itemtype="http://schema.org/InteractionCounter"> <meta itemprop="interactionType" content="http://schema.org/LikeAction"/> <meta itemprop="userInteractionCount" content="1" /> <span class='post-likes'>1 Spice up</span> </div> </div> </div> <div id="related-topics" class="more-topics__list " role="complementary" aria-labelledby="related-topics-title"> <h3 id="related-topics-title" class="more-topics__list-title"> Related topics </h3> <div class="topic-list-container" itemscope itemtype='http://schema.org/ItemList'> <meta itemprop='itemListOrder' content='http://schema.org/ItemListOrderDescending'> <table class='topic-list'> <thead> <tr> <th>Topic</th> <th></th> <th class="replies">Replies</th> <th class="views">Views</th> <th>Activity</th> </tr> </thead> <tbody> <tr class="topic-list-item" id="topic-list-item-951400"> <td class="main-link" itemprop='itemListElement' itemscope itemtype='http://schema.org/ListItem'> <meta itemprop='position' content='1'> <span class="link-top-line"> <a itemprop='url' href='https://community.spiceworks.com/t/new-compromise-tactics/951400' class='title raw-link raw-topic-link'>New compromise tactics?</a> </span> <div class="link-bottom-line"> <a href='/c/cloud-computing-saas/8' class='badge-wrapper bullet'> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name'>Cloud Computing & SaaS</span> </span> </a> <div class="discourse-tags"> <a href='https://community.spiceworks.com/tag/email' class='discourse-tag'>email</a> , <a href='https://community.spiceworks.com/tag/microsoft-office-365' class='discourse-tag'>microsoft-office-365</a> , <a href='https://community.spiceworks.com/tag/question' class='discourse-tag'>question</a> </div> </div> </td> <td class="replies"> <span class='posts' title='posts'>6</span> </td> <td class="views"> <span class='views' title='views'>182</span> </td> <td> May 9, 2023 </td> </tr> <tr class="topic-list-item" id="topic-list-item-587823"> <td class="main-link" itemprop='itemListElement' itemscope itemtype='http://schema.org/ListItem'> <meta itemprop='position' content='2'> <span class="link-top-line"> <a itemprop='url' href='https://community.spiceworks.com/t/users-email-compromised-through-a-number-of-hacked-lists-solutions/587823' class='title raw-link raw-topic-link'>User's email compromised through a number of hacked lists, solutions?</a> </span> <div class="link-bottom-line"> <a href='/c/security/28' class='badge-wrapper bullet'> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name'>Security</span> </span> </a> <div class="discourse-tags"> <a href='https://community.spiceworks.com/tag/discussion' class='discourse-tag'>discussion</a> , <a href='https://community.spiceworks.com/tag/general-it-security' class='discourse-tag'>general-it-security</a> </div> </div> </td> <td class="replies"> <span class='posts' title='posts'>10</span> </td> <td class="views"> <span class='views' title='views'>278</span> </td> <td> June 16, 2017 </td> </tr> <tr class="topic-list-item" id="topic-list-item-122355"> <td class="main-link" itemprop='itemListElement' itemscope itemtype='http://schema.org/ListItem'> <meta itemprop='position' content='3'> <span class="link-top-line"> <a itemprop='url' href='https://community.spiceworks.com/t/hack/122355' class='title raw-link raw-topic-link'>hack</a> </span> <div class="link-bottom-line"> <a href='/c/security/28' class='badge-wrapper bullet'> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name'>Security</span> </span> </a> <div class="discourse-tags"> <a href='https://community.spiceworks.com/tag/discussion' class='discourse-tag'>discussion</a> , <a href='https://community.spiceworks.com/tag/general-it-security' class='discourse-tag'>general-it-security</a> </div> </div> </td> <td class="replies"> <span class='posts' title='posts'>8</span> </td> <td class="views"> <span class='views' title='views'>40</span> </td> <td> January 23, 2012 </td> </tr> <tr class="topic-list-item" id="topic-list-item-663768"> <td class="main-link" itemprop='itemListElement' itemscope itemtype='http://schema.org/ListItem'> <meta itemprop='position' content='4'> <span class="link-top-line"> <a itemprop='url' href='https://community.spiceworks.com/t/lets-talk-about-those-porn-blackmail-e-mails-with-passwords/663768' class='title raw-link raw-topic-link'>Let's Talk About Those Porn Blackmail E-Mails With Passwords</a> </span> <div class="link-bottom-line"> <a href='/c/security/28' class='badge-wrapper bullet'> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name'>Security</span> </span> </a> <div class="discourse-tags"> <a href='https://community.spiceworks.com/tag/general-it-security' class='discourse-tag'>general-it-security</a> , <a href='https://community.spiceworks.com/tag/windows-10' class='discourse-tag'>windows-10</a> , <a href='https://community.spiceworks.com/tag/webroot' class='discourse-tag'>webroot</a> , <a href='https://community.spiceworks.com/tag/question' class='discourse-tag'>question</a> </div> </div> </td> <td class="replies"> <span class='posts' title='posts'>11</span> </td> <td class="views"> <span class='views' title='views'>228</span> </td> <td> July 25, 2018 </td> </tr> <tr class="topic-list-item" id="topic-list-item-566435"> <td class="main-link" itemprop='itemListElement' itemscope itemtype='http://schema.org/ListItem'> <meta itemprop='position' content='5'> <span class="link-top-line"> <a itemprop='url' href='https://community.spiceworks.com/t/someone-is-spoofing-our-domain-for-emails/566435' class='title raw-link raw-topic-link'>Someone is spoofing our domain for emails</a> </span> <div class="link-bottom-line"> <a href='/c/security/28' class='badge-wrapper bullet'> <span class='badge-category-bg' style='background-color: #0088CC'></span> <span class='badge-category clear-badge'> <span class='category-name'>Security</span> </span> </a> <div class="discourse-tags"> <a href='https://community.spiceworks.com/tag/discussion' class='discourse-tag'>discussion</a> , <a href='https://community.spiceworks.com/tag/anti-spam' class='discourse-tag'>anti-spam</a> </div> </div> </td> <td class="replies"> <span class='posts' title='posts'>8</span> </td> <td class="views"> <span class='views' title='views'>102</span> </td> <td> March 20, 2017 </td> </tr> </tbody> </table> </div> </div> </div> <footer class="container wrap"> <nav class='crawler-nav'> <ul> <li itemscope itemtype='http://schema.org/SiteNavigationElement'> <span itemprop='name'> <a href='/' itemprop="url">Home </a> </span> </li> <li itemscope itemtype='http://schema.org/SiteNavigationElement'> <span itemprop='name'> <a href='/categories' itemprop="url">Categories </a> </span> </li> <li itemscope itemtype='http://schema.org/SiteNavigationElement'> <span itemprop='name'> <a href='/guidelines' itemprop="url">Guidelines </a> </span> </li> <li itemscope itemtype='http://schema.org/SiteNavigationElement'> <span itemprop='name'> <a href='https://www.spiceworks.com/terms' itemprop="url">Terms of Service </a> </span> </li> <li itemscope itemtype='http://schema.org/SiteNavigationElement'> <span itemprop='name'> <a href='https://www.spiceworks.com/privacy' itemprop="url">Privacy Policy </a> </span> </li> </ul> </nav> <p class='powered-by-link'>Powered by <a href="https://www.discourse.org">Discourse</a>, best viewed with JavaScript enabled</p> </footer> <noscript> <img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=6488140&fmt=gif"> </noscript> <script defer="" src="https://sea3.discourse-cdn.com/spiceworks/theme-javascripts/b488d0bc271fc4584be7d0599ed4675117022f39.js?__ws=community.spiceworks.com" data-theme-id="27" nonce="hXsi31Xq357zW9ktnmu8CK4YL"></script> <!-- Google Tag Manager (noscript) --> <noscript> <iframe src="https://www.googletagmanager.com/ns.html?id=GTM-KTKRL68F" height="0" width="0" style="display:none;visibility:hidden"></iframe> </noscript> <!-- End Google Tag Manager (noscript) --> <noscript><img height="1" width="1" src="//zdbb.net/l/z0WVjCBSEeGLoxIxOQVEwQ/" alt=""></noscript> <div class="buorg"><div>Unfortunately, <a href="https://www.discourse.org/faq/#browser">your browser is unsupported</a>. Please <a href="https://browsehappy.com">switch to a supported browser</a> to view rich content, log in and reply.</div></div> <script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8e94cd6b6b3340f7',t:'MTczMjczODY1NC4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script></body> </html>