Same thing happened to me on an @outlook.com account that has only been used to send mail to three recipients since it was created.
MS owned offending IP: 13.101.55.39
Did a whois, and saw it was MS owned. Was worried it might just be MS being broken and alerting on their own stuff, so didn't flag it, and got another attempt from the same IP a couple hours later. Flagged it then.
Could be an attacker using Azure to host attacks, but since my @outlook.com email address is not really guessable nor in circulation (long, not dictionary words/names, and only used a few times) MS just being broken might be more likely?
Another option is Cloudflare + MS's new relationship to provide Warp VPN as a built-in for Edge results in Warp sometimes terminating directly within MS address space?
> Are you using Cloudflare's Warp VPN on any devices that might be accessing the email accounts via IMAP?
No.
I'm not even using this account for e-mail or anything. It uses @gmail.com address, so I don't think it even has e-mail? Not quite sure how that works.
I was forced to switch from Mojang Minecraft account to Microsoft account for Minecraft to keep working properly.
MS owned offending IP: 13.101.55.39
Did a whois, and saw it was MS owned. Was worried it might just be MS being broken and alerting on their own stuff, so didn't flag it, and got another attempt from the same IP a couple hours later. Flagged it then.
Could be an attacker using Azure to host attacks, but since my @outlook.com email address is not really guessable nor in circulation (long, not dictionary words/names, and only used a few times) MS just being broken might be more likely?
Another option is Cloudflare + MS's new relationship to provide Warp VPN as a built-in for Edge results in Warp sometimes terminating directly within MS address space?
https://www.zdnet.com/article/microsoft-readies-a-built-in-v...
I'm currently using Warp on my phone to avoid spying by my carrier (who is known to be terrible about this).
Are you using Cloudflare's Warp VPN on any devices that might be accessing the email accounts via IMAP?