Multiple logins to my MS account from an MS-owned IP address in Ireland?

Today I looked at the recent activity page on MS’s website and noticed that there were 6 or 7 successful logins to my MS account from an IP address in Ireland, spread out through December. I’m in England. An example: –

https://i.imgur.com/WpPeYJo.jpg

When I did a reverse DNS lookup on the IP, I got this: –

View post on imgur.com

msnbot-40-77-182-102.search.msn.com, owned by Microsoft.

Any idea what’s going on here? I have 2 factor auth enabled on my account and have received no notifications asking me to authorise logins and nothing has been added to, nor changed on my account, so I’m wondering if the recent activity page is logging something it shouldn’t be logging. I’ve changed my password just in case.

Conversation 7 comments

  • DJS

    02 January, 2019 - 7:09 pm

    <p>To add to the above, I just checked again and the IP address differs slightly each time, but all originate in Ireland and all are supposedly owned by Microsoft.</p>

  • wright_is

    Premium Member
    03 January, 2019 - 12:23 am

    <p>Do you use any MS online services which interract with each other?</p><p>Office plugins?</p><p>Do you have 2FA turned on? When not, you should enable it.</p>

  • Paul Thurrott

    Premium Member
    03 January, 2019 - 9:13 am

    <p>Microsoft does have major Internet data centers in Ireland. Where do you live?</p>

  • Alexander Rothacker

    Premium Member
    03 January, 2019 - 11:21 am

    <p>This made me look and I found a similar login that happened just yesterday.</p><p><br></p><p>Name:&nbsp;&nbsp;&nbsp;msnbot-131-253-35-169.search.msn.com</p><p>Address:&nbsp;131.253.35.169</p><p><br></p><p>I'm pretty sure that at the time this happened I used an Office Home code that I had bought from Amazon during their recent sale. I tried using it on the microsoft.com site, where I was redirected to the office.com site and automatically logged in.</p><p><br></p><p>Any chance you did something similar?</p><p><img src=""></p>

  • DJS

    04 January, 2019 - 4:51 am

    <p>I use Office 365, but I hadn't redeemed a code to renew it. I don't use any Office plugins. I only really bought 365 for the OneDrive storage, so I just use a couple of the Office apps as they come with no add-ons or plugins.</p><p><br></p><p>I have 2FA turned on, but I received no notifications asking me to authorise these logins.</p><p><br></p><p>I'm in England, so not super far from the data centre in question, but still, why do these entries even exist?</p>

    • wright_is

      Premium Member
      04 January, 2019 - 5:54 am

      <blockquote><em><a href="#390740">In reply to DJS:</a></em></blockquote><p>Did you open OneDrive? Open it in a browser?</p><p>It sounds like it is an automatic search or logon bot running in the background.</p>

      • DJS

        04 January, 2019 - 6:38 am

        <blockquote><em><a href="#390751">In reply to wright_is:</a></em></blockquote><p><br></p><p>I don't think there's any action that I've done that matches up with the logins, and a couple of them occurred during days/times while I was in bed asleep and my devices were turned off.</p>

Windows Intelligence In Your Inbox

Sign up for our new free newsletter to get three time-saving tips each Friday

"*" indicates required fields

This field is for validation purposes and should be left unchanged.

Thurrott © 2024 Thurrott LLC