Unusual Account Activity from MS IP Addresses

Anonymous
2022-07-15T04:15:50+00:00

Yesterday I received an email from your Microsoft Account Team regarding unusual activity.  When I looked into it, it showed an unusual actvity detected for an Automatic POP3 sync from IP 13.101.248.75.  This activity did not have my account alias listed as it usually does, and listed the location as United States.  On the review activity page I said this was not me.  I changed my password, but then saw another unusual account activity from IP 13.101.248.41. This one did have my account alias listed.   I changed my passwords almost 1/2 dozen times yesterday.24hrs after my final password change, I received today another email regarding unusual activity.  It was another unusual activity detected for an Automatic POP3 sync from IP 13.101.248.75. Once again I confirmed this was not me, although this time I did not change my password.  Three hours later, I received yet another notification of unusual activity.  This time it was for IP 13.101.219.207  However, at the same time it had the exact same thing for IP address 13.101.53.212.  While I was not notified of that one, nor asked to confirm if this was me, it does list it as unusual activity. I looked all the IP address up on ARIN WHOIS.  According to them they all belong to Microsoft. I am sending this to all the email addresses on ARIN WHOIS that are listed as a point of contact.  I NEED ANSWERS. This has never happened before yesterday. I am afraid to confirm that these are me because I don't understand why MS IPs would be POP3 syncing to my account. I only have my Gmail account to POP3 sync to this email.  Those IP addresses tend to begin with a 2607 number.  I keep saying this isn't me, but not sure what I should do. Ignore, confirm it's me or continue to say it's not me. I want to know why is a Microsoft IP auto syncing to my email account? So much so that it generates an unusual activity text/email?I NEED some guidance on this.  There is no help article covering this.  And there is no way to contact a live person for help, which is ABSOLUTELY RIDICULOUS!

Outlook | Windows | Classic Outlook for Windows | For business

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2022-07-19T21:48:24+00:00

Finally got to talk to someone at MS- this was their reply:

Thank you for the information. Please be advise that Microsoft is aware of this known issue already. This started to happen even last week and we are already working with this matter. We even have created a ticket number for this issue while it is still happening.

The ticket number for the emerging issue is INC31680156.

So they are on it, but no idea when it will be fixed.

[EDIT] They also confirmed that the account was secure, no need to change passwords, etc

Was this answer helpful?

30+ people found this answer helpful.
0 comments

52 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2022-07-18T06:54:03+00:00

    Hi!

    I can confirm the problem. Also these warnings, starting some days ago, time corresponding real time I checked mail.

    MS IPs: 13.101.172.234, 13.101.111.232, 13.101.111.208, 13.101.252.206...

    Affecting more MS accounts (but not all I have, but most of them). Changing password or log out didn't work
    WIN 10, last build, updates, AV. Using The Bat! as mail client.

    I hope the issue will be resolved soon.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2022-07-18T08:31:09+00:00

    Same issue here.

    Email sync via POP3 using Gmail.

    I am regularly getting "Unusual activity" warnings from Microsoft own IP addresses. (mid July 2022)

    Fix this MS

    Was this answer helpful?

    0 comments
  3. Anonymous
    2022-07-18T08:33:48+00:00

    Exact same issue from varying IP addresses, all in the 13.101.*.* range:

    13.101.240.47

    13.101.225.182

    Protocol: POP3 IP: 13.101.225.182Account alias:
    @live.com Time: 9 hours agoApproximate location: United StatesType: Unusual activity detected

    whois 13.101.225.182

    % IANA WHOIS server

    % for more information on IANA, visit http://www.iana.org

    % This query returned 1 object

    refer:        whois.arin.net

    inetnum:      13.0.0.0 - 13.255.255.255

    organisation: Administered by ARIN

    status:       LEGACY

    whois:        whois.arin.net

    changed:      1991-09

    source:       IANA

    # whois.arin.net

    NetRange:       13.64.0.0 - 13.107.255.255

    CIDR:           13.104.0.0/14, 13.64.0.0/11, 13.96.0.0/13

    NetName:        MSFT

    NetHandle:      NET-13-64-0-0-1

    Parent:         NET13 (NET-13-0-0-0-0)

    NetType:        Direct Allocation

    OriginAS:       

    Organization:   Microsoft Corporation (MSFT)

    RegDate:        2015-03-26

    Updated:        2021-12-14

    Ref:            https://rdap.arin.net/registry/ip/13.64.0.0

    OrgName:        Microsoft Corporation

    OrgId:          MSFT

    Address:        One Microsoft Way

    City:           Redmond

    StateProv:      WA

    PostalCode:     98052

    Country:        US

    RegDate:        1998-07-10

    Updated:        2022-03-28

    Comment:        To report suspected security issues specific to traffic emanating from Microsoft online services, including the distribution of malicious content or other illicit or illegal material through a Microsoft online service, please submit reports to:

    Comment:        * https://cert.microsoft.com.  

    Comment:        

    Comment:        For SPAM and other abuse issues, such as Microsoft Accounts, please contact:

    Comment:        * abuse@microsoft.com.  

    Comment:        

    Comment:        To report security vulnerabilities in Microsoft products and services, please contact:

    Comment:        * secure@microsoft.com.  

    Comment:        

    Comment:        For legal and law enforcement-related requests, please contact:

    Comment:        * msndcc@microsoft.com

    Comment:        

    Comment:        For routing, peering or DNS issues, please 

    Comment:        contact:

    Comment:        * IOC@microsoft.com

    Ref:            https://rdap.arin.net/registry/entity/MSFT

    OrgAbuseHandle: MAC74-ARIN

    OrgAbuseName:   Microsoft Abuse Contact

    OrgAbusePhone:  +1-425-882-8080 

    OrgAbuseEmail:  abuse@microsoft.com

    OrgAbuseRef:    https://rdap.arin.net/registry/entity/MAC74-ARIN

    OrgTechHandle: IPHOS5-ARIN

    OrgTechName:   IPHostmaster, IPHostmaster 

    OrgTechPhone:  +1-425-538-6637 

    OrgTechEmail:  iphostmaster@microsoft.com

    OrgTechRef:    https://rdap.arin.net/registry/entity/IPHOS5-ARIN

    OrgTechHandle: MRPD-ARIN

    OrgTechName:   Microsoft Routing, Peering, and DNS

    OrgTechPhone:  +1-425-882-8080 

    OrgTechEmail:  IOC@microsoft.com

    OrgTechRef:    https://rdap.arin.net/registry/entity/MRPD-ARIN

    Was this answer helpful?

    0 comments
  4. Anonymous
    2022-07-18T09:02:32+00:00

    Hi Jennifer McClain

    Thank you for your efforts, we are actively collecting these issues and communicating with internal staff. If there are new developments, we will let you know.

    Was this answer helpful?

    0 comments