My outlook account notices some unusual IMAP Login from Microsoft at Redmond

Anonymous

I'm noticed from Microsoft Account Service that my outlook account has been exposed some IMAP Logins from each of the IPv4 addresses at 13.101.0.0-13.101.255.255 since 2022-07-11 JST informed as "unusual activity".

And I found with using whois service that these IP may be managed by Microsoft and placed at Redmond city in US.

Yeah I changed PW in usual way but these access can't stop anyway, so I'm guessing this is a specification for Outlook service.

But at the same time I am afraid of some attacks to Outlook service or Microsoft's collection of users data.

Does Anyone know some information about these kinds of access?

I already used technical help service of online chats in Japan, but he said that he doesn't have some clear idea.

Notification

Thanks to any users to read this thread and report the same issue.

I guess you all are as anxious as I am, but I'd like you to just keep focus on the topic of "unusual activity" from 13.101.0.0/16 here.

While many attacks on login to some system will happen all the time around the world, Thus this case is unique in that it's coming from IPv4 addresses inside Microsoft.

And here we hope to solve this strange problem.

Thank you for your cooperation.

S.E.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

User @Chezlong Just placed this on my forum post

https://answers.microsoft.com/en-us/outlook_com/forum/all/unusual-account-activity-from-ms-ip-addresses/974cc1c1-232f-44a2-b0eb-0f378fd2c801?page=5:

Finally got to talk to someone at MS- this was their reply:

Thank you for the information. Please be advise that Microsoft is aware of this known issue already. This started to happen even last week and we are already working with this matter. We even have created a ticket number for this issue while it is still happening.

The ticket number for the emerging issue is INC31680156.

So they are on it, but no idea when it will be fixed.

[EDIT] They also confirmed that the account was secure, no need to change passwords, etc

AND

Found the following on thread https://answers.microsoft.com/en-us/outlook\_com/forum/all/outlook-mail-account-unusual-activity/6cfb226f-8cd7-41ae-bd0a-a80d100af543?page=9

posted by user @Pierre-LucMorais:

I have looked for other means to communicate to MS and I found an “official” thread to post this problem. Your mile may vary but i’ve had a reply on my thread and encourage ppl to try using them as well ?

https://www.reddit.com/r/microsoft/comments/o22lfc/microsoft\_official\_support\_thread/

They’ve responded that it is a backend accessing the service and a known issue.

Hoping this helps

0 comments

Answer accepted by question author

Anonymous

Outlook email users alerted to suspicious activity from Microsoft-owned IP address—
People turn amateur sleuths to discover that the source of all those sign-ins seems to be in Redmond
https://www.theregister.com/2022/07/21/outlook_sign_ins/
Article has an update at the end:

Updated at 09.33 UTC on 22 July 2022 to add:
Following publication of this article, Microsoft sent us a statement:
"We're working to resolve a configuration issue causing some customers to receive these notifications in error," said a Microsoft spokesperson via email.

0 comments

56 additional answers

Anonymous

2022-07-15T13:52:12+00:00

That´s an interessting behavior.

I use Outlook, and for backup purposes I sync mails via IMAP with a linux tool.

This sync runs every half an hour.

But those 13.101 sync occurs totally random, I cannot recognize a pattern.

It also occurs when I stop this cron job.

Good point, why should Microsoft use IMAP?... I don´t know. But I don´t have unsuccessful accesses since two days.

It startet two days ago with several unsuccessful access tries, respectively it was like "no, no, yes, no, yes ,yes no"....

Then a few hours later all access activities were successful and still are despite of password changes.

If it would be an malicious actor who guessed my password (which btw is pretty unlikely) then it should stop somehow.

Another point is: how should a malicious actor gain access without further interaction/phishing etc. when 2FA is enabled?

Very strange!!
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Anonymous

2022-07-15T13:20:06+00:00

I'm also still hoping it is Microsoft doing this, but if it was Microsoft, why would so many login attempts be failing? Why would they be using IMAP?

Stefan are you using any kind of email client or just the web interface?

I did not have thunderbird running since yesterday, and the 13.101 logins stopped during that time. I just let thunderbird try to sync again (with the wrong password) and simultaneously 2 of the 13.101. addresses try to sync (and failed, probably because they are copying).
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Anonymous

2022-07-15T02:44:03+00:00

I followed the suggestion and opened a case at the link suggested...

However, this doesnt seem to "adress" the issue or security flaw... they just answered very quickly that they "took action against the user"...

Here is what I received :

"This message is to notify you that the Computer Emergency Response Team has reviewed your reported issue and has actioned it appropriately.

The activity reported is associated with a customer account within the Microsoft Azure service. Microsoft Azure provides a cloud computing platform in which customers can deploy their own software applications. Customers, not Microsoft, control what applications are deployed on their account."
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments