Microsoft account unusual sign-in activity email, -----> Is this phishing?

Anonymous

Is this legit?

If so, what should I look for and do?

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

122 answers

Anonymous

I just got the same email saying a successful sign in from Madrid with the Australian IP address. The email said it was ******@microsft.com, but the log in and change notification links were to someone else's Hotmail.

Signin details
Country/region: Spain/Madrid
IP address: 103.251.12.244
Date: Mon, 20 Feb 2023 12:58:36 +0000
Platform: Windows 11
Browser: Chrome
A user from Russia/Moscow just logged into your account from a new device, If this wasn't you, please report the user. If this was you, we'll trust similar activity in the future.

The report the user shows: ******@hotmail.com?&cc=******@hotmail.com&subject=unusual%20signin%20activity&body=Report%20The%20User

The click here shows: ******@hotmail.com?&cc=******@hotmail.com&Subject=Unsubscribe+me

0 comments

Anonymous

2023-02-20T15:23:42+00:00

The email I got same day (this morning) lists the exact same title & details, even the exact same IP Address, but the date in my email has a slightly different time (12:50:23 +0000). This info does not match up with a recent login attempt (looking at my Recent Activity page).

If I reply to the email though, shows me emailing to <@hotmail.com>. If I click one of the links in the email, then it has me mailing to <@hotmail.com>. Which clearly do not seem like Microsoft accounts.

But coincidentally, my Recent Activity page shows so many unsuccessful login attempts from different countries I can only see back to Feb 7, so I just deleted the email & set up 2 factor authentication on my account, setup the Microsoft Authenticator app & an app password for some devices, & wrote down my recovery code.
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments

Anonymous

Microsoft account
Unusual signin activity
We detected something unusual about a recent signin to the Microsoft account ******@hotmail.com.
Signin details
Country/region: Spain/Madrid
IP address: 103.251.12.244
Date: Mon, 20 Feb 2023 11:21:51 +0000
Platform: Windows 11
Browser: Chrome
A user from Russia/Moscow just logged into your account from a new device, If this wasn't you, please report the user. If this was you, we'll trust similar activity in the future.
	Report The User	<br>	---
To opt out or change where you receive security notifications, click here.
Thanks,
The Microsoft account team

0 comments

Anonymous

2023-02-20T15:32:16+00:00

What about this one 2nd one today - I stupidly reported the first one by clicking it
Was this answer helpful?

0 comments No comments

Anonymous

Microsoft account

Unusual signin activity

We detected something unusual about a recent signin to the Microsoft account *** Email address is removed for privacy ***.

Signin details

Country/region: Spain/Madrid

IP address: 103.251.12.244

Date: Mon, 20 Feb 2023 11:21:51 +0000

Platform: Windows 11

Browser: Chrome

A user from Russia/Moscow just logged into your account from a new device, If this wasn't you, please report the user. If this was you, we'll trust similar activity in the future.

Report The User <br> ---

To opt out or change where you receive security notifications, click here.

Thanks,

The Microsoft account team

I got the same email at 03:45 PST on 2/20/2023. Text is the same to the letter.

Total phishing. First give away is no hyphen in sign-in. Second is that all of the click points are a "mailto:******@hotmail.com."

The Microsoft and the Outlook Spam Filters should easily detect this and block this email. Please do so ASAP!

0 comments