Unusual Account Activity from MS IP Addresses

Anonymous
2022-07-15T04:15:50+00:00

Yesterday I received an email from your Microsoft Account Team regarding unusual activity.  When I looked into it, it showed an unusual actvity detected for an Automatic POP3 sync from IP 13.101.248.75.  This activity did not have my account alias listed as it usually does, and listed the location as United States.  On the review activity page I said this was not me.  I changed my password, but then saw another unusual account activity from IP 13.101.248.41. This one did have my account alias listed.   I changed my passwords almost 1/2 dozen times yesterday.24hrs after my final password change, I received today another email regarding unusual activity.  It was another unusual activity detected for an Automatic POP3 sync from IP 13.101.248.75. Once again I confirmed this was not me, although this time I did not change my password.  Three hours later, I received yet another notification of unusual activity.  This time it was for IP 13.101.219.207  However, at the same time it had the exact same thing for IP address 13.101.53.212.  While I was not notified of that one, nor asked to confirm if this was me, it does list it as unusual activity. I looked all the IP address up on ARIN WHOIS.  According to them they all belong to Microsoft. I am sending this to all the email addresses on ARIN WHOIS that are listed as a point of contact.  I NEED ANSWERS. This has never happened before yesterday. I am afraid to confirm that these are me because I don't understand why MS IPs would be POP3 syncing to my account. I only have my Gmail account to POP3 sync to this email.  Those IP addresses tend to begin with a 2607 number.  I keep saying this isn't me, but not sure what I should do. Ignore, confirm it's me or continue to say it's not me. I want to know why is a Microsoft IP auto syncing to my email account? So much so that it generates an unusual activity text/email?I NEED some guidance on this.  There is no help article covering this.  And there is no way to contact a live person for help, which is ABSOLUTELY RIDICULOUS!

Outlook | Windows | Classic Outlook for Windows | For business

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2022-07-19T21:48:24+00:00

Finally got to talk to someone at MS- this was their reply:

Thank you for the information. Please be advise that Microsoft is aware of this known issue already. This started to happen even last week and we are already working with this matter. We even have created a ticket number for this issue while it is still happening.

The ticket number for the emerging issue is INC31680156.

So they are on it, but no idea when it will be fixed.

[EDIT] They also confirmed that the account was secure, no need to change passwords, etc

Was this answer helpful?

30+ people found this answer helpful.
0 comments

52 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2022-07-21T18:40:17+00:00

    I am having the same issue!! Very unsettling! So much gets sorted through email from various accounts and purchases. I am getting the same unusual sign on activity messages. I have tried both indicating that is not me and indicating that it is me. I have reset my password at least 3 times and I continue to get these notices! Do I need to completely deactivate this email and use gmail?

    Was this answer helpful?

    0 comments
  2. Anonymous
    2022-07-21T22:34:32+00:00

    Similar problems to the above, caused a huge headache. This does not inspire confidence in MS products that they do not recognise their own IP addresses

    Was this answer helpful?

    0 comments
  3. Anonymous
    2022-07-21T23:16:41+00:00

    And I use Thunderbird.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2022-07-22T02:46:00+00:00

    Received this response on 07/20 for my help ticket:

    I would like to inform you that we are aware of the issue and we are investigating this issue with our Engineering team and we will get back to them once we have a update from the Engineering team.

    Last time I received an unusual activity detected for MS IP 13.101 variation was 07/19 4:32pm CST. However, I did find a successful sync from today at about 6:42pm CST for IP: 2a00:1450:4864:20::626. When I looked this IP up, it says it belongs to RIPE Network Coordination center out of Amsterdam!! https://whois.arin.net/rest/net/NET6-2A00-1/pft?s=2a00%3A1450%3A4864%3A20%3A%3A626

    Clicked the secure your account link, and it tells me I have already secured my account since this activity occured. Which isn't the case. So I had to manually go in and change my password.

    Cuz who the hell is RIPE from Amsterdam, and why are they syncing with my account.

    From what I can find: The RIPE NCC is one of five Regional Internet Registries (RIRs) providing Internet resource allocations, registration services and coordination activities that support the operation of the Internet globally. We're an independent, not-for-profit membership organisation that supports the infrastructure of the Internet through technical coordination in our service region. Our most prominent activity is to act as the Regional Internet Registry (RIR) providing global Internet resources and related services (IPv4, IPv6 and AS Number resources) to members in our service region. 

    It seems like Microsoft is tied to them somehow. But I don't understand how. Best guess is MS purchased and is using some of the IPv6 addresses from RIPE, and this is still a MS IP doing some weird sync to my account. It's all a little above my paygrade. Changed my password to be safe. If after I change my password, they sync with me again, then I guess I'll have my answer that it's definitely tied to MS.

    Was this answer helpful?

    0 comments