Multiple logins to my MS account from an MS-owned IP address in Ireland?

7

Today I looked at the recent activity page on MS’s website and noticed that there were 6 or 7 successful logins to my MS account from an IP address in Ireland, spread out through December. I’m in England. An example: –

https://i.imgur.com/WpPeYJo.jpg

When I did a reverse DNS lookup on the IP, I got this: –

View post on imgur.com

msnbot-40-77-182-102.search.msn.com, owned by Microsoft.

Any idea what’s going on here? I have 2 factor auth enabled on my account and have received no notifications asking me to authorise logins and nothing has been added to, nor changed on my account, so I’m wondering if the recent activity page is logging something it shouldn’t be logging. I’ve changed my password just in case.

Comments (7)

7 responses to “Multiple logins to my MS account from an MS-owned IP address in Ireland?”

  1. DJS

    To add to the above, I just checked again and the IP address differs slightly each time, but all originate in Ireland and all are supposedly owned by Microsoft.

  2. wright_is

    Do you use any MS online services which interract with each other?

    Office plugins?

    Do you have 2FA turned on? When not, you should enable it.

  3. Paul Thurrott

    Microsoft does have major Internet data centers in Ireland. Where do you live?

  4. Alexander Rothacker

    This made me look and I found a similar login that happened just yesterday.


    Name:   msnbot-131-253-35-169.search.msn.com

    Address: 131.253.35.169


    I'm pretty sure that at the time this happened I used an Office Home code that I had bought from Amazon during their recent sale. I tried using it on the microsoft.com site, where I was redirected to the office.com site and automatically logged in.


    Any chance you did something similar?

  5. DJS

    I use Office 365, but I hadn't redeemed a code to renew it. I don't use any Office plugins. I only really bought 365 for the OneDrive storage, so I just use a couple of the Office apps as they come with no add-ons or plugins.


    I have 2FA turned on, but I received no notifications asking me to authorise these logins.


    I'm in England, so not super far from the data centre in question, but still, why do these entries even exist?

    • wright_is

      In reply to DJS:

      Did you open OneDrive? Open it in a browser?

      It sounds like it is an automatic search or logon bot running in the background.

      • DJS

        In reply to wright_is:


        I don't think there's any action that I've done that matches up with the logins, and a couple of them occurred during days/times while I was in bed asleep and my devices were turned off.