Unusual Account Activity from MS IP Addresses

Anonymous
2022-07-15T04:15:50+00:00

Yesterday I received an email from your Microsoft Account Team regarding unusual activity.  When I looked into it, it showed an unusual actvity detected for an Automatic POP3 sync from IP 13.101.248.75.  This activity did not have my account alias listed as it usually does, and listed the location as United States.  On the review activity page I said this was not me.  I changed my password, but then saw another unusual account activity from IP 13.101.248.41. This one did have my account alias listed.   I changed my passwords almost 1/2 dozen times yesterday.24hrs after my final password change, I received today another email regarding unusual activity.  It was another unusual activity detected for an Automatic POP3 sync from IP 13.101.248.75. Once again I confirmed this was not me, although this time I did not change my password.  Three hours later, I received yet another notification of unusual activity.  This time it was for IP 13.101.219.207  However, at the same time it had the exact same thing for IP address 13.101.53.212.  While I was not notified of that one, nor asked to confirm if this was me, it does list it as unusual activity. I looked all the IP address up on ARIN WHOIS.  According to them they all belong to Microsoft. I am sending this to all the email addresses on ARIN WHOIS that are listed as a point of contact.  I NEED ANSWERS. This has never happened before yesterday. I am afraid to confirm that these are me because I don't understand why MS IPs would be POP3 syncing to my account. I only have my Gmail account to POP3 sync to this email.  Those IP addresses tend to begin with a 2607 number.  I keep saying this isn't me, but not sure what I should do. Ignore, confirm it's me or continue to say it's not me. I want to know why is a Microsoft IP auto syncing to my email account? So much so that it generates an unusual activity text/email?I NEED some guidance on this.  There is no help article covering this.  And there is no way to contact a live person for help, which is ABSOLUTELY RIDICULOUS!

Outlook | Windows | Classic Outlook for Windows | For business

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2022-07-19T21:48:24+00:00

Finally got to talk to someone at MS- this was their reply:

Thank you for the information. Please be advise that Microsoft is aware of this known issue already. This started to happen even last week and we are already working with this matter. We even have created a ticket number for this issue while it is still happening.

The ticket number for the emerging issue is INC31680156.

So they are on it, but no idea when it will be fixed.

[EDIT] They also confirmed that the account was secure, no need to change passwords, etc

Was this answer helpful?

30+ people found this answer helpful.
0 comments

52 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2022-07-16T15:53:25+00:00

    Just received two texts from MS. One from number 91703 and one from 58419. Login, and I have two unusual account activity reports I need to verify. The IP addresses are once again tied to MS. I have also sent emails to every single one of the emails listed on the WHOIS-RWS page - abuse, secure, ippostmaster. Have not received any new information from my ticket since I sent detailed information and links to multiple posts on this. I even reported here: https://msrc.microsoft.com/create-report

    We're all left fumbling around in the dark, worried we're being hacked, and MS is not responding anywhere it seems.

    Was this answer helpful?

    5 people found this answer helpful.
    0 comments
  2. Anonymous
    2022-07-16T13:04:56+00:00

    +1

    IMAP syncs from US (I'm in Australia) from IP 13.101.68.183. Apparently a MS data centre.

    Was this answer helpful?

    5 people found this answer helpful.
    0 comments
  3. Anonymous
    2022-07-16T13:45:20+00:00

    HI.

    I found this thread. Which provides details as well. Shows all the threads that have been started regarding this issue. He even tried enabling 2F authentication, and still has the issue. He has a support ticket as well.

    This is clearly a MS deal.

    https://answers.microsoft.com/en-us/outlook_com/forum/all/outlook-mail-account-unusual-activity/6cfb226f-8cd7-41ae-bd0a-a80d100af543

    I even have a thread from 2015 with the exact same thing happening.

    https://answers.microsoft.com/en-us/outlook_com/forum/all/microsoft-account-unusual-sign-in-activity-ip-is/893dd29e-ff5c-48b5-a7d6-4588d5e83fc6

    A user managed to get this response (I guess back when you could call and get a live person.

    :S >>>>Good day! I understand the situation you are in and let me do my best to help you. Please be informed that IP addresses from Microsoft are generated from when your account is accessed by our system to apply updates to the account. This is the system accessing the account, not any particular individual from Microsoft accessing the account. <<<<

    IF this is true, we as users need to be made aware of this. And if it's going to flag as unusual activity, we need to be told whether to ignore it or verify it is us. It's frustrating that this keeps occurring and there is no help documentation on this, nor a MS generated email that goes out to users that explain the situation. This is really just poor customer service, IMO

    I also found an article regarding deprecation of basic authentication. The article makes it sound like MS is trying to move users away from POP3 and IMAP imports, and force us into downloading their app on our mobile devices. But I will admit, I didn't completely understand this article: https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  4. Anonymous
    2022-07-16T13:08:08+00:00

    @Chandy,

    Also reinforcing MinMin's comment, this is something on your side, as you now have multiple threads about this. Either you're having a data breach occur or your servers are having synch issues which we are copping the authentication errors from.

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments