Microsoft account sign-in activity page shows unusual locations

POP Peeper: Tech support, suggestions, discussion, etc.
Post Reply
waya
Posts: 4
Joined: Fri Jul 15, 2022 2:58 am

Microsoft account sign-in activity page shows unusual locations

Post by waya »

Hi! I hope someone can help me with this issue.
Microsoft (to be exact, the sign-in activity check) keeps blocking my Hotmail account because it tracks an unusual connection.
In fact, as you can see below, the synchronization seem to happen in US but I'm in Europe:
Protocol: POP3
IP: 13.101.127.74
Account alias:
xxxxxxxx@hotmail.com
Time: 22 minutes ago
Approximate location: United States
Type: Successful sync
Look unfamiliar?
Secure your account


Does anyone know what this is all about? And what's the IP address? Is it Pop Peeper's?

Thanks in advance
waya
User avatar
mjs
Moderator
Posts: 2216
Joined: Sun Jul 17, 2011 2:36 am

Re: Microsoft account sign-in activity page shows unusual locations

Post by mjs »

Welcome to the forum waya,

Here is a webpage on how to Check the recent sign-in activity for your Microsoft account.

You'll want to determine if the "sign in" activity appears to be valid by looking at your recent activity (there is a blue "See your recent activity" button for this in this linked page) to check on when and where you've presumably used your account. Clicking on this button will require you to login to the MS Account (MS will send a code to verify you) and then you will get a list of "Recent Activity" (data on when and where the account was logged-in) including Device and Browser used and IP location (presumably your IP) along with a map displaying the approximate location (for past logins).

And here's more on What is the Recent activity page?

The specific IP Address you're asking about appears to be one of Microsoft's IP addresses at the Microsoft Corporation Services Data-Center in the City of Redmond of the State of Washington USA.

Hope this helps. :wink:

Other members of the Esumsoft Team may be posting additional information about this as well. Also as a new member of the forum, we recommend you take a look at this information for new users & forum members topic when you have the time that serves as a general guide/introduction to the Esumsoft Forums.
Good judgment comes from experience and a lot of that comes from bad judgment. - Will Rogers
User avatar
mjs
Moderator
Posts: 2216
Joined: Sun Jul 17, 2011 2:36 am

Re: Microsoft account sign-in activity page shows unusual locations

Post by mjs »

As a followup -- This morning I've had 3 of my accounts send me the same kind of messages:
This actually only involves 3 different accounts - as MS often sends duplicate messages and each message typically involves an alternate account on file as well (so what you get is usually double, or more, messages in regards to how many accounts are actually involved).
This actually only involves 3 different accounts - as MS often sends duplicate messages and each message typically involves an alternate account on file as well (so what you get is usually double, or more, messages in regards to how many accounts are actually involved).
After clicking on this button in your (Inbox) message(s):
You can click the screen-shot (images) to enlarge for improved visibility (to return to forum topic use your browser back-arrow).
You can click the screen-shot (images) to enlarge for improved visibility (to return to forum topic use your browser back-arrow).
Always make sure to check the box in the screen-shot below (assuming you're on a device that you usually use):
This will help mitigate the times you need to reply with a code when responding to these types of messages and should (hopefully) help avoid more of these kinds of (annoyance) messages going forward.
This will help mitigate the times you need to reply with a code when responding to these types of messages and should (hopefully) help avoid more of these kinds of (annoyance) messages going forward.
Good judgment comes from experience and a lot of that comes from bad judgment. - Will Rogers
waya
Posts: 4
Joined: Fri Jul 15, 2022 2:58 am

Re: Microsoft account sign-in activity page shows unusual locations

Post by waya »

Oh sure, I know the step-by-step. I suppose I will flag that activity as safe.
Anyway, I just wanted to know if it's normal that there are syncs from other locations.
It seems like it's common, so it's fine.
Mystery solved.
Thanks for your help
User avatar
Jeff
Admin / Developer
Posts: 9226
Joined: Sat Sep 08, 2001 9:46 pm

Re: Microsoft account sign-in activity page shows unusual locations

Post by Jeff »

waya -- If you are using POP3 in POP Peeper and/or another email client and you think that the times match up with a time when PP or the other client connected, it's probably OK. Are you using Oauth2?

mjs -- Do your reports also mention the POP3 protocol and would that be accurate for your usage? Are you using Oauth2?

The reason I'm asking -- I have 2 hotmail accounts and I haven't seen any reports. However, both my accounts are using IMAP with Oauth2, so many POP3 was a factor? But also: I've been noticing suspicious activity in my web-server logs (ie. attempting to access files that have no reason to be accessed, immediately before the website goes down) and the last several IP addresses I've checked have all been supposedly Microsoft-owned.

So, I'm not so sure that I would mark those activities as safe unless you're sure that they make sense. Unless MS is doing something weird with the Oauth2 validation, I wouldn't think that it would report PP's usage as coming from a different IP address other than your own (at least, it shouldn't, and this would be a Microsoft flaw if it then reports it as suspicious activity).
User avatar
mjs
Moderator
Posts: 2216
Joined: Sun Jul 17, 2011 2:36 am

Re: Microsoft account sign-in activity page shows unusual locations

Post by mjs »

All of my messages with the subject "Microsoft account unusual sign-in activity" (as referenced in this topic) all use IMAP (w/ Oauth2) and are designated as such ("IMAP") by Microsoft when I check on them. And in each case the IP Addresses (that are not necessarily all the same specific IP) included in each of the reports are a Microsoft IP address located in the city of Redmond in the State of Washington U.S.A.
Good judgment comes from experience and a lot of that comes from bad judgment. - Will Rogers
User avatar
mjs
Moderator
Posts: 2216
Joined: Sun Jul 17, 2011 2:36 am

Re: Microsoft account sign-in activity page shows unusual locations

Post by mjs »

Jeff, MS has already locked (initiated ~2 weeks ago) one of my accounts for 30 days while MS takes that time to verify me and ultimately reset my recovery data at some point presumably after that so I can once again use the account. This is very troublesome for me in as much as I'm expecting very critical emails from some businesses that are using this Email account (that I can't very easily change at this point for these businesses involved in the recent critical correspondence). So what this means is I cannot log into this account on the Web for 30 days and of course cannot setup the account in an Email Client either and in the intervening time the account has unfortunately stopped working in my Email Client on my Win7 Desktop. I'm fortunate however in that this same account they've locked up for 30 days in the interim still works in POP Peeper as well as TB on my Win10 Laptop (so I can still access messages including most critically the Junk folders in the event a critical message ends up there). If not for my ability to access the account on my Laptop, I would be in a world-of-hurt having to wait 30 days (still 2+ weeks remaining) to access this account.

I'm of the attitude that I don't want to rock-the-boat any more than I have to as long as I can still get to the Inboxes for any of my email accounts actually as well as other critical folders on my Desktop while MS might in some cases otherwise decide to dither-around and hold an account hostage while they take their own sweet time to "verify" me (which I frankly resent as I know it's my account even if they apparently do not!!).

Bottom line: I tend to not want to report too much to MS (or any email service for that matter) because of my concern they'll tend to make things even worse for me than they already are. I frankly do not correspond with the Pentagon or have access to secrets concerning Fort Knox - so any messages that involve my Email Accounts aren't something I worry about someone (anyone) reading anyway. My main concern is to retain access to my accounts (who might read them be damned) so I can continue to use them and not get locked out of them. As you know, I've abruptly lost around 4-5 Gmail accounts totally (over the years) simply because Gmail was not able to recover the accounts (fortunately nothing critical gets used in Gmail in my case) - but I'd rather not have similar problems with my MS accounts. I think you get the jest here, I am not a fan of all of this overblown security as far as the direction so many various enterprises are headed. Forgive me as I'll digress just a tad more here in this regard - I've found out just this morning I cannot access (login) to Home Depot (apparently because of their decision to use 2-step logins). After spending about 45 minutes using multiple browsers in various safe-mode functions I was able to get a code sent to me. This should have ended the fiasco - but still, I find I cannot login to the website (even though I responded with the verification code they sent to my email account) - how does that make any sense. These kinds of things are far too common place. All of this ridiculous concern about security is resulting in the irresponsible disabling of legitimate accounts far too often. Oh, and btw, calling Home Depot is no help as they either disconnect or the auto-voice system loops endlessly offering zero relevant assistance. I can talk forever on bank and savings accounts as well that mess up their software security infrastructure far too often (I've in the past spent literal days with these kinds of issues with establishments - not so much any more as I've sort of given-up on expectations of well functioning sites in many cases) - but I'll stop right here.... My point is, in regards to Email, I don't really care who reads my emails (hence Email security is not what I worry that much about - any time I might actually have security concerns I'll typically use an end-to-end encrypted Email account in that case) - in general my imperatives focus more on simply being able to use my email accounts than anything else....
Good judgment comes from experience and a lot of that comes from bad judgment. - Will Rogers
waya
Posts: 4
Joined: Fri Jul 15, 2022 2:58 am

Re: Microsoft account sign-in activity page shows unusual locations

Post by waya »

@Jeff
What's happening to MJS is exactly what's happening to me (minus the 30 days block - that is what I was afraid of). Exactly as MJS, I avoid to flag those activities because it might get much worse.
Anyway, I know now it's Microsoft (probably some weird Oauth2 check), so it's fine.
I was confused because I had sync attempts from all over the world (this Hotmail address of mine ended up online, in many leaked data db's) but only one was successful and it was from the IP address 13.101.127.xxx. MJS confirmed it was MS's.
So... all good now
User avatar
mjs
Moderator
Posts: 2216
Joined: Sun Jul 17, 2011 2:36 am

Re: Microsoft account sign-in activity page shows unusual locations

Post by mjs »

I continue to get these "Unusual Activity" intermittent messages from MS (on both of my Win10/Win7 machines) - so looking into this further I have found the following linked topics (among many) - it appears MS "security" has gone awry - so I'm ignoring the messages as reportedly confirmed by MS in point #1):

1) Unusual Account Activity from MS IP Addresses - created July 14, 2022
Apparent conclusion:
Finally got to talk to someone at MS- this was their reply:

Thank you for the information. Please be advise that Microsoft is aware of this known issue already. This started to happen even last week and we are already working with this matter. We even have created a ticket number for this issue while it is still happening.

The ticket number for the emerging issue is INC31680156.

So they are on it, but no idea when it will be fixed.

[EDIT] They also confirmed that the account was secure, no need to change passwords, etc



2) I keep getting an email from Microsoft Account Team indicating unusual activity and there are entries to confirm - created July 15, 2022
Apparent conclusion:
There are many threads about this very topic - one of which is the following where the person has opened a support case with Microsoft and is waiting for a response
OUTLOOK MAIL ACCOUNT - UNUSUAL ACTIVITY
https://answers.microsoft.com/en-us/outlook_com...

3) Microsoft account unusual sign-in activity‏ IP is Miscrosoft IP????? - created January 17, 2015
Apparent conclusion (based on the comment: "17 people found this reply helpful").
Ravinath, you are posting the same canned response about checking the recent activity page, which I've obviously done or I would not have known the IP that was generating the unusual sign-in activity. The specific question is why Microsoft corporate IP addresses are generating suspicious activity? I contacted support directly yesterday and received this response this morning:

>>>>Good day! I understand the situation you are in and let me do my best to help you. Please be informed that IP addresses from Microsoft are generated from when your account is accessed by our system to apply updates to the account. This is the system accessing the account, not any particular individual from Microsoft accessing the account. <<<<

So, according to this response, Microsoft itself is generating this activity as part of server(account?) updates. If this is true, Microsoft should make some adjustments to the security logging routines so that Microsoft created administrative activity does not trigger these alerts. I have spent at least 2 hours changing my passwords, setting up 2 factor authentication, updating all my devices that access hotmail, searching support forums and contacting MS support, just to learn at this point that there is not a problem because Microsoft is triggering false alerts through upgrade/administration activity.


.... If anyone can find more conclusive information on this issue - please post in this topic.
Last edited by mjs on Thu Jul 21, 2022 10:26 pm, edited 1 time in total.
Reason: Edited to correct "created date" on last link to the accurate date - note this last thread is quite clear back in 2015
Good judgment comes from experience and a lot of that comes from bad judgment. - Will Rogers
User avatar
Jeff
Admin / Developer
Posts: 9226
Joined: Sat Sep 08, 2001 9:46 pm

Re: Microsoft account sign-in activity page shows unusual locations

Post by Jeff »

Makes me wonder why I'm *not* getting the unusual activity alerts... 8-[

btw, regarding the 3rd link you shared -- the date is actually from 2015, not 2022. So this isn't the first time they've had this problem.
User avatar
mjs
Moderator
Posts: 2216
Joined: Sun Jul 17, 2011 2:36 am

Re: Microsoft account sign-in activity page shows unusual locations

Post by mjs »

Jeff, do you on regular intervals use two different computers at the same time (with PP running on both)?

I know I don't "usually" myself (hence the "unusual" would be the case for me recently)... :) - that is, that's possibly where the "unusual activity" comes into play in my case...

The days I got the "unusual activity" messages were on 7-14, 7-15, 7-17 and 7-20 and 7-21. There was a hiatus (no MS messages) on 7-16, 7-18 and 7-19 during this period period of time between 7-14 through 7-21. It does appear that these dates (when I did get the "unusual activity" messages) may have corresponded to when I happened to be using both my laptop and desktop at the same time.

As mentioned, I have been using my desktop (instead of my "usual" behavior of using the laptop) due to the hot weather - but because MS locked the one specific account that I was using to correspond with a company during the dates referenced above, I at times also needed to occasionally use the laptop (because I was only able to check the "Junk" folder for messages on the laptop as this was the folder where the messages from that company were ending up during this time).

So it could be that while my Desktop was not sleeping (as it usually is in as much as "sleep" state is triggered by 40 minutes of inactivity) and perhaps at the same time as well my laptop was not shutdown (because I needed to check the "locked" account on the laptop) there would have been times when PP may have been checking messages in close proximity of time on both computers thus perhaps triggering the "Unusual Activity" warning from MS (since I virtually never us the Desktop, but have a lot more in recent days).

My correspondence has been resolved as of the 21st (and I haven't had any more "unusual activity" messages since that date) - and because I will not likely be using my laptop much anymore for awhile, I'll keep an eye out to see if the "unusual activity" messages continue to not be the case anymore as of 7-21. I would add that with the "hiatus" dates (7-16, 7-18 thru 7-19) appearing to also align with when I wouldn't have likely been using both computers as I wasn't expecting correspondence on those specific dates - as contrasted to when I likely did use the laptop (at the same time as the Desktop) which was when I was expecting replies from the company (hence both computers may have been in use on those respective days).

Bottom line: I would say that Emails getting checked via two different IP's (as would be the case during these days referenced above via PP due to sporadic use of two computers - of which there would be Mail Checks set for 12 and 15 minute intervals on the laptop and desktop, respectively) would arguably qualify as "unusual activity" (in my case) as contrasted to my "usual" behavior of using just the one computer absent this current spell of hot weather. :-k
(hmm, well shut-my-mouth! :-#... am I defending MS? #-o ... sort of feels a little strange :-&)

Oh, btw - I fixed the ("created") date 8) .... (thanks for the heads-up).
Good judgment comes from experience and a lot of that comes from bad judgment. - Will Rogers
waya
Posts: 4
Joined: Fri Jul 15, 2022 2:58 am

Re: Microsoft account sign-in activity page shows unusual locations

Post by waya »

@mjs
It's definitely what you say here:
<< [...] there would have been times when PP may have been checking messages in close proximity of time on both computers thus perhaps triggering the "Unusual Activity" warning from MS [...]>>
I use two laptops and on both PP checks messages every 5 minutes; I suppose it triggers MS check.
Thanks mjs for your deep investigation.
User avatar
Jeff
Admin / Developer
Posts: 9226
Joined: Sat Sep 08, 2001 9:46 pm

Re: Microsoft account sign-in activity page shows unusual locations

Post by Jeff »

And, no, I don't use PP on 2 different computers, so it seems you've found the cause.

Two computers within the same internal network would have the same external IP address. Apparently MS doesn't take that into account when delivering the warning messages.
Post Reply