Microsoft account unusual sign-in activity email, -----> Is this phishing?

Microsoft account
Unusual signin activity
We detected something unusual about a recent signin to the Microsoft account *** Email address is removed for privacy ***.
Signin details
Country/region: Spain/Madrid
IP address: 103.251.12.244
Date: Mon, 20 Feb 2023 11:21:51 +0000
Platform: Windows 11
Browser: Chrome
A user from Russia/Moscow just logged into your account from a new device, If this wasn't you, please report the user. If this was you, we'll trust similar activity in the future.
	Report The User	<br>	---
To opt out or change where you receive security notifications, click here.
Thanks,
The Microsoft account team

I got the same email at 03:45 PST on 2/20/2023. Text is the same to the letter.

Total phishing. First give away is no hyphen in sign-in. Second is that all of the click points are a "mailto:******@hotmail.com."

The Microsoft and the Outlook Spam Filters should easily detect this and block this email. Please do so ASAP!

The email I got same day (this morning) lists the exact same title & details, even the exact same IP Address, but the date in my email has a slightly different time (12:50:23 +0000). This info does not match up with a recent login attempt (looking at my Recent Activity page).

If I reply to the email though, shows me emailing to <@hotmail.com>. If I click one of the links in the email, then it has me mailing to <@hotmail.com>. Which clearly do not seem like Microsoft accounts.

But coincidentally, my Recent Activity page shows so many unsuccessful login attempts from different countries I can only see back to Feb 7, so I just deleted the email & set up 2 factor authentication on my account, setup the Microsoft Authenticator app & an app password for some devices, & wrote down my recovery code.

I just got the same email saying a successful sign in from Madrid with the Australian IP address. The email said it was ******@microsft.com, but the log in and change notification links were to someone else's Hotmail.

The report the user shows: ******@hotmail.com?&cc=******@hotmail.com&subject=unusual%20signin%20activity&body=Report%20The%20User

The click here shows: ******@hotmail.com?&cc=******@hotmail.com&Subject=Unsubscribe+me

I found the alert e-mail in my junk file, and it was from 'Microsoft account team <no-reply@microsoft.com>'

Is this legit?

And why was it in my junk email file?

William

Daily I am getting an email virtually identical to this:

Microsoft account           

Unusual sign-in activity 

We detected something unusual about a recent sign-in to the Microsoft account @hotmail.com <mailto:@techconsulting-alerts-1.com?&cc=******@techconsulting-alerts-1.com&Subject=Report+The+User> .      

Sign-in details   

Country/region: Russia/Moscow              

IP address: 103.225.77.255          

Date: Sat, 19 Nov 2022 00:56:49 +0000  

Platform: Windows 10   

Browser: Firefox              

A user from Russia/Moscow just logged into your account from a new device, If this wasn't you, please report the user. If this was you, we'll trust similar activity in the future.       

Report The User <mailto:@techconsulting-alerts-1.com?&cc=@techconsulting-alerts-1.com&subject=unusual sign-in activity&body=Report The User>          

To opt out or change where you receive security notifications, click here <mailto:@techconsulting-alerts-1.com?&cc=@techconsulting-alerts-1.com&Subject=Unsubscribe+me> .       

Thanks,

The Microsoft account team      

 <http://thbe7op.com/track/o9442FmrZM9098509oBVZ392470GuH11664egeg176>