My outlook account notices some unusual IMAP Login from Microsoft at Redmond

Anonymous
2022-07-12T08:27:40+00:00

I'm noticed from Microsoft Account Service that my outlook account has been exposed some IMAP Logins from each of the IPv4 addresses at 13.101.0.0-13.101.255.255 since 2022-07-11 JST informed as "unusual activity".

And I found with using whois service that these IP may be managed by Microsoft and placed at Redmond city in US.

Yeah I changed PW in usual way but these access can't stop anyway, so I'm guessing this is a specification for Outlook service.

But at the same time I am afraid of some attacks to Outlook service or Microsoft's collection of users data.

Does Anyone know some information about these kinds of access?

I already used technical help service of online chats in Japan, but he said that he doesn't have some clear idea.

Notification

Thanks to any users to read this thread and report the same issue.

I guess you all are as anxious as I am, but I'd like you to just keep focus on the topic of "unusual activity" from 13.101.0.0/16 here.

While many attacks on login to some system will happen all the time around the world, Thus this case is unique in that it's coming from IPv4 addresses inside Microsoft.

And here we hope to solve this strange problem.

Thank you for your cooperation.

S.E.

Outlook | Web | Outlook.com | Account management, security, and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2022-07-19T22:42:18+00:00

User @Chezlong Just placed this on my forum post

https://answers.microsoft.com/en-us/outlook_com/forum/all/unusual-account-activity-from-ms-ip-addresses/974cc1c1-232f-44a2-b0eb-0f378fd2c801?page=5:

Finally got to talk to someone at MS- this was their reply:

Thank you for the information. Please be advise that Microsoft is aware of this known issue already. This started to happen even last week and we are already working with this matter. We even have created a ticket number for this issue while it is still happening.

The ticket number for the emerging issue is INC31680156.

So they are on it, but no idea when it will be fixed.

[EDIT] They also confirmed that the account was secure, no need to change passwords, etc

AND

Found the following on thread https://answers.microsoft.com/en-us/outlook\_com/forum/all/outlook-mail-account-unusual-activity/6cfb226f-8cd7-41ae-bd0a-a80d100af543?page=9

posted by user @Pierre-LucMorais:

I have looked for other means to communicate to MS and I found an “official” thread to post this problem. Your mile may vary but i’ve had a reply on my thread and encourage ppl to try using them as well ?

https://www.reddit.com/r/microsoft/comments/o22lfc/microsoft\_official\_support\_thread/

They’ve responded that it is a backend accessing the service and a known issue.

Hoping this helps

Was this answer helpful?

10 people found this answer helpful.
0 comments
Answer accepted by question author
Anonymous
2022-07-22T15:39:05+00:00

Outlook email users alerted to suspicious activity from Microsoft-owned IP address—
People turn amateur sleuths to discover that the source of all those sign-ins seems to be in Redmond
https://www.theregister.com/2022/07/21/outlook_sign_ins/
Article has an update at the end:

Updated at 09.33 UTC on 22 July 2022 to add:
Following publication of this article, Microsoft sent us a statement:
"We're working to resolve a configuration issue causing some customers to receive these notifications in error," said a Microsoft spokesperson via email.

Was this answer helpful?

2 people found this answer helpful.
0 comments

56 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2022-07-17T01:52:33+00:00

    I've noticed that if you use POP instead of IMAP, the suspects start using POP as well, showing that they are indeed copying our every move. What do you think this might mean? There are definitely accesses from these same addresses that don't coincide with our legit logins as well. If not for that I would think microsoft is proxying our connections and the proxy appears in the list by mistake.

    I can confirm this at my end too.

    Another pattern is that accounts on which the authentication mechanism over SSL/TLS was set to "TLS Certificate" in Thunderbird some years ago have not shown unusual activity, yet. Only the accounts for which authentication over SSL/TLS was set to "Normal Password" are showing the unusual activity. Thunderbird no longer allows the setting of TLS Certificate as it is outdated.

    I learned about this from others, and I was able to replicate the same. One of my very old accounts had TLS Certificate over SSL/TLS setting. I changed that to Normal Password yesterday, mostly because after clicking that dropdown box, I could no longer choose TLS Certificate, and Outlook only worked with the Normal Password option among all the items in the dropdown. Within a few hours, the 13.101.x.x intrusions began. For the first 2 attempts, Microsoft informed me. Thereafter Microsoft didn't. Only the 1st attempt was blocked by Microsoft, and the 2nd one onwards it successfully sync'ed.

    When I changed my account access between POP and IMAP, the intrusions changed to that last used protocol too. After I changed password, and remained logged in within the browser, the new attempts failed.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2022-07-16T22:31:57+00:00

    Adding myself to this thread so I get updates. I've also made a post before running into this thread.

    I use Windows Live Mail over IMAP and MS Outlook app (Android) to connect to my Outlook.com account, and the unusual sign-ins *seem* to coincide with the timing of those apps. However, upon reading other comments, that doesn't mean the connection attempts are legit.

    I'm going to change my password and cease account access over IMAP on email clients for the time being. Hopefully there would be an announcement somewhere to notify us what the issue is and resolution status.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  3. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more