[63852] in SIPB bug reports
Microsoft account unusual sign-in activity
daemon@ATHENA.MIT.EDU (Microsoft account team)
Wed Aug 19 18:50:30 2020
From account-security-noreply@mail.msa.msidentity.com Wed Aug 19 22:50:28 2020
Return-Path: <account-security-noreply@mail.msa.msidentity.com>
Delivered-To: bug-sipb-mtg@CHARON.mit.edu
Received: (qmail 3433 invoked from network); 19 Aug 2020 22:50:28 -0000
Received: from outgoing-exchange-3.mit.edu (18.9.28.13)
by charon.mit.edu with SMTP; 19 Aug 2020 22:50:28 -0000
Received: from oc11exedge1.exchange.mit.edu (OC11EXEDGE1.EXCHANGE.MIT.EDU [18.9.3.17])
by outgoing-exchange-3.mit.edu (8.14.7/8.12.4) with ESMTP id 07JLU0XY007477
for <bug-sipb-mtg@bloom-picayune.mit.edu>; Wed, 19 Aug 2020 17:30:09 -0400
Received: from w92exhyb2.exchange.mit.edu (18.7.71.32) by
oc11exedge1.exchange.mit.edu (18.9.3.17) with Microsoft SMTP Server (TLS) id
15.0.1293.2; Wed, 19 Aug 2020 17:27:32 -0400
Received: from oc11exhyb1.exchange.mit.edu (18.9.1.60) by
w92exhyb2.exchange.mit.edu (18.7.71.32) with Microsoft SMTP Server (TLS) id
15.0.1395.4; Wed, 19 Aug 2020 17:27:46 -0400
Received: from NAM12-BN8-obe.outbound.protection.outlook.com (104.47.55.168)
by oc11exhyb1.exchange.mit.edu (18.9.1.60) with Microsoft SMTP Server (TLS)
id 15.0.1395.4 via Frontend Transport; Wed, 19 Aug 2020 17:27:45 -0400
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=XHahXC/RZyagiAfChyjUh2tslvcTMEuF7gJzTPybjKMfE0/Zt4TwHjvlVOCh2v9KEcYwSuK2bqvWeaf3if8CUfzALR7OtW/fESgWxCgGCf7meoVplQlQWlIgPVMUNxR53jjq0LA9aKokdZtsmFJmN/wjuCDzSTLjXP6L8FdtOQYRWXoFmgGKaXsVLRf4TVzvJfQkO1jrs/G41yw2cHR6GxGYZ2b1FMguuw41+Y1XS8nFAT6W8sOE3SUCQ1sqMjsMUJm+9rwxQVxIr1DXDgsYj3fDgmoG7o1fIJXbI8ImvZG9upMVwtGOTLwtHqu7CeI/8kFVNZkT/eeAS6JI6ogR0g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=pPLM4mRnAjiU16xWtzS2wrOg3f2tGeu0bqKOkipSwqc=;
b=T3WxpXEkROym4m1HG/7dEbOBbck2yz/d8Av0//TcXr/F8Sm+BA8LV8aXmjKLOHJNir1I9HLqn+EJy2PcakMLi4wIyNGs3KUrhwA6dsrqjRbH4VVX8JsZq5jZD3MjiJdg1E+lWnS+WeL0oNjHUzOxf4CF7m8LN/qTucKpTV11L448ygT+E+CW4kS4XhxL5FXO6yDUKELIP6pSg3UsesAz7EhnzmeSv+XgnwSEfgX4ZoMki0upzI0UGe1y7zJ/Cu90naVl+Js2SkX86I2ViVDNGS+DSq62kudW+8RWhELCvXvwB8ju2FSCfcnGHagJXem22tSK0XxQ4GEbMYnhBMlp2A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=pPLM4mRnAjiU16xWtzS2wrOg3f2tGeu0bqKOkipSwqc=;
b=Gpwf21ywC9zi4Gnkl4UnJqiCjsQxADgurAtHgJtKyPcT9Wbo6ltZVJSgp0iuAoueOvv4zdy+k8cAAV/pxxuBqhoAROx5GKlIU09AW+FRiVjhXugbzgDO/lUZ8pCzZnRPvrm8tGPLRuAQBtp8IlSMUoDKRMOCSMsrfWpMPvnvbNo=
Received: from DM6PR13CA0044.namprd13.prod.outlook.com (2603:10b6:5:134::21)
by BL0PR01MB5297.prod.exchangelabs.com (2603:10b6:208:33::20) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.3283.15; Wed, 19 Aug 2020 21:27:45 +0000
Received: from DM3NAM03FT031.eop-NAM03.prod.protection.outlook.com
(2603:10b6:5:134:cafe::e1) by DM6PR13CA0044.outlook.office365.com
(2603:10b6:5:134::21) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3305.15 via Frontend
Transport; Wed, 19 Aug 2020 21:27:44 +0000
Authentication-Results: spf=fail (sender IP is 92.204.160.105)
smtp.mailfrom=accountprotection.microsoft.com; mit.edu; dkim=none (message
not signed) header.d=none;mit.edu; dmarc=fail action=oreject
header.from=accountprotection.microsoft.com;
Received-SPF: Fail (protection.outlook.com: domain of
accountprotection.microsoft.com does not designate 92.204.160.105 as
permitted sender) receiver=protection.outlook.com; client-ip=92.204.160.105;
helo=server.domain.com;
Received: from server.domain.com (92.204.160.105) by
DM3NAM03FT031.mail.protection.outlook.com (10.152.82.199) with Microsoft SMTP
Server id 15.20.3305.24 via Frontend Transport; Wed, 19 Aug 2020 21:27:44
+0000
Received: from [92.204.160.107] (localhost [IPv6:::1])
by server.domain.com (Postfix) with SMTP id CB5DF9090D1
for <bug-sipb@mit.edu>; Mon, 17 Aug 2020 10:47:54 -0400 (EDT)
Message-ID: <G3Q7CED6-QSW-1PC5-87Z4-VVTNYIXK2R1@accountprotection.microsoft.com>
MIME-Version: 1.0
From: Microsoft account team <account-security-noreply@mail.msa.msidentity.com>
To: bug-sipb <bug-sipb@mit.edu>
Subject: Microsoft account unusual sign-in activity
Date: Mon, 17 Aug 2020 15:48:04 -0700
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 9478f568-aa83-4f07-74be-08d84486b655
X-MS-TrafficTypeDiagnostic: BL0PR01MB5297:
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-Transport-Forked: True
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <BL0PR01MB5297F038132F9000996F67A9895D0@BL0PR01MB5297.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:8882;
X-MS-Exchange-SenderADCheck: 2
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: =?utf-8?B?VVRxNjNiMjZmZ05kVkNkMDhUbmMzdEtmT0dnZmhYTzIyQnVCdHlJS3BiOTFX?=
=?utf-8?B?ZXN1VEx4cnRtc2YvRi8zTStCZ0k5Wkw5REMybjJFTTJGZkozSGhMVGx6Q05t?=
=?utf-8?B?OWFnU1hRRXFHUkZCYlYydjZHVnJxUU91dElqWWlVazhYekE5RFg1YVQxSXNt?=
=?utf-8?B?YXBBOE1EVVVCOG9wc2dNRTFzZjdNTzBkZjVld2ZIbDFXbUozalA4M1d0eXUx?=
=?utf-8?B?VncvRjdueWFmMmRRT2UwSlhpZFFUd01RaWRBU1ZVZWtZN2x3aVVXQmMzcEhE?=
=?utf-8?B?bngvZ3hZNjdEM1I1S3kvQmtRMWppcHlsR3JXNFZuK0N2WjlkT2k5V2NDT1lQ?=
=?utf-8?B?L1lqU2R3c3hJSEJRTHZpNnE0Y1hFWFlYUHhhYXRVQUpEZzRuTFBGRjFoM3Ex?=
=?utf-8?B?Z0FqQzAra3hvNFBFWjExQUFnRHFqNHRaTThIRHZDdFFrS0JWemNxUTdiMnIz?=
=?utf-8?B?VG9ZdXFuRS91U29MbG1KSG16MFY3ZFIySTVmZW5BUng3dElndXZkRHpJNmJY?=
=?utf-8?B?Z2x0bktZTTZ5L3c1YXlrWjhWZGpmbm5RTEVCeUF4Smtnd1k3TDFLQmhrYXl2?=
=?utf-8?B?bS8rMDd0OVZTMUpyNW11RHB3MndoazJGcElzTzhpV3JTYnpaTEpZUktyODVJ?=
=?utf-8?B?NG00eWVqWTVDMjVxbnpMckJjQzFWNEZWTmZPOCtnU2F3MzE0N1ZVWUxITnN2?=
=?utf-8?B?UjRyek9JaTVvVnVmWGRUVk9QbnF2Wm5GcncxRm04SUs2THJzdUJHN1lzVXFn?=
=?utf-8?B?Ti9hcWJxVlBydDkvNW1aR3g2emJKWXR1T2FHTEtlZy9ZTEpoQlQyaG0zeCs3?=
=?utf-8?B?VERFVDV4Yi93ZVJqb3lpY3N6QWhSVWp6cThGRmxKUm9wOGlSRkMwcGVnaVhK?=
=?utf-8?B?aU45SFN1cUJXVE1mbFhucnp3NUtPcWRqYTFaNzV6Z3ZBVkR2cnZRRHA3dXpp?=
=?utf-8?B?ZnVtOXlzdkZJOFF0R1NlcndyZEY2Q1VMZWNWM3ptaCs0bWlyUFlXeGw4QjNN?=
=?utf-8?B?NUp2M1lWMzdUT1JjY3NObFEzdW96WXVzWXF4bDk3K2dudFNINHV4YnFOUzNO?=
=?utf-8?B?U083Sy92ZlQwVWphUjk0QWpQSm12SzFGdVNybERwMVJOdWhHTGt3NXpvYjBo?=
=?utf-8?B?dHlJUlRXcnRhbWVKWGYzbkcyNVRWSjRqczV1cXdSZHB4VDgrT2F5azdrdGVo?=
=?utf-8?B?YzgrUmxDb3Rxa0d1UjJvczA5bEJhWUVvMDJ5SXJCQ1VUK0hkaXRkdGJ3MGtQ?=
=?utf-8?B?cm9LbjRHQi95QzY2K05raDlqbmROLzdvYWM1aFdIWnRocHY4c2xXZ1psWlZ5?=
=?utf-8?B?OVNRVGt0SHdHQjZkQlZ5QVBXMEpkWXd6S3pYelVSMVpNcGxDTVpNVW9wZURT?=
=?utf-8?B?aWVyUmpZSkxYUEZ6eEZnbFFvTVhoNzN1ZnRHMXNWUCsvTkx6akZjQ1JuZFdi?=
=?utf-8?B?SWtRWHhESHUxdmhqK3ZuL2NqYndNZWZCNWs2YXdXUWNMY1lsQ2lCMmdnNlBl?=
=?utf-8?B?bDB6R2hSU2JkMVBWcG41VWswYTdTTUZ6d3RUSXJqM3U0VmY4LzlPTU1XSHVw?=
=?utf-8?B?cWpmZnJOYzNJUzBadWhmcDNnZW55SGFPOHZEazJ4WnBveXhsMlV6VEoxS3VZ?=
=?utf-8?B?WkJaTTJWUHZtQ29mUmlFb292aUFlcVBYRS9DeUlEYTZKUzdrU09jYVdJUkhK?=
=?utf-8?B?L2t1NDkvYjMzL2J6S3lId1I2cFVVSExNRkE4amplNXFwWXN5VEg1NlZVMXVQ?=
=?utf-8?B?OHBDRHN1aGhOTm52UDFUVHJuZzlmN3d1Vnh3R2k0ckRSMjZYdW85S0tsSEZv?=
=?utf-8?B?NmZ0dGJ2aU01bkJhUWd4NjNEUEdrbEdNVmJ1TWdMSDRSL3RYRjNTMDN0K0Iz?=
=?utf-8?B?R3V3MFNzNVJJcURwZUx6YWRYUFB2SUcrV01GaGN6cHVnUUFpS0lpK2FXUlBw?=
=?utf-8?B?cHhBekZqc0FRMTFmbkpyTDUwQjVHRHk4WTJzRGl4TnRHb1pCNEJxd0tqNFRS?=
=?utf-8?B?QUN1WnM2SFF3PT0=?=
X-Forefront-Antispam-Report: CIP:92.204.160.105;CTRY:;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:server.domain.com;PTR:InfoDomainNonexistent;CAT:OSPM;SFS:(4636009)(376002)(396003)(39860400002)(136003)(346002)(47530400004)(47690400004)(166002)(316002)(5660300002)(2616005)(956004)(498600001)(356005)(2906002)(6266002)(36906005)(6862004)(70586007)(786003)(68406010)(81166007)(15650500001)(26005)(4186021)(52230400001)(83380400001)(4744005)(33656002)(336012)(86362001)(10290500003)(40265005)(8676002)(9240055009)(121820200001)(6666004)(43490500001);DIR:OUT;SFP:1501;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Aug 2020 21:27:44.5416
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 9478f568-aa83-4f07-74be-08d84486b655
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: DM3NAM03FT031.eop-NAM03.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR01MB5297
X-OriginatorOrg: mitprod.onmicrosoft.com
<html>
<head>
<title></title>
</head>
<body>
<div aria-label=3D"Message Body" aria-multiline=3D"true" class=3D"Am Al edi=
table LW-avf tS-tW tS-tY" contenteditable=3D"true" g_editable=3D"true" id=
=3D":8u" role=3D"textbox" spellcheck=3D"false" style=3D"direction: ltr; min=
-height: 85px;" tabindex=3D"1">
<div class=3D"gmail_quote">
<div dir=3D"ltr">
<div>
<div>
<div>
<table dir=3D"ltr">
<tbody>
<tr>
<td id=3D"m_-1766465224118982526m_7993604742473822961x_i1" style=3D"padding=
:0;font-family:'Segoe UI Semibold','Segoe UI Bold','Segoe UI','Helvetica Ne=
ue Medium',Arial,sans-serif;font-size:17px;color:#707070">Microsoft account=
</td>
</tr>
<tr>
<td id=3D"m_-1766465224118982526m_7993604742473822961x_i2" style=3D"padding=
:0;font-family:'Segoe UI Light','Segoe UI','Helvetica Neue Medium',Arial,sa=
ns-serif;font-size:41px;color:#2672ec">Verify your account</td>
</tr>
<tr>
<td id=3D"m_-1766465224118982526m_7993604742473822961x_i3" style=3D"padding=
:0;padding-top:25px;font-family:'Segoe UI',Tahoma,Verdana,Arial,sans-serif;=
font-size:12px;color:#2a2a2a">We detected something unusual about a recent =
sign-in for the Microsoft account <a href=3D"mailto:bug-sipb@mit=2Eedu" tar=
get=3D"_blank">bug-sipb@mit=2Eedu</a>=2E For example, you might be signing =
in from a new location, device, or app=2E</td>
</tr>
<tr>
<td id=3D"m_-1766465224118982526m_7993604742473822961x_i4" style=3D"padding=
:0;padding-top:25px;font-family:'Segoe UI',Tahoma,Verdana,Arial,sans-serif;=
font-size:12px;color:#2a2a2a">To help keep you safe, we've blocked acce=
ss to your inbox, contacts list, and calendar=2E Please review your recent =
activity and we'll help you take corrective action=2E To regain access,=
you'll need to confirm that the recent activity was yours=2E</td>
</tr>
<tr>
<td style=3D"padding:0;padding-top:25px;font-family:'Segoe UI',Tahoma,Verda=
na,Arial,sans-serif;font-size:12px;color:#2a2a2a">
<table border=3D"0" cellspacing=3D"0">
<tbody>
<tr>
<td bgcolor=3D"#2672ec" style=3D"background-color:#2672ec;padding-top:5px;p=
adding-right:20px;padding-bottom:5px;padding-left:20px;min-width:50px"><a d=
ata-saferedirecturl=3D"https://www=2Egoogle=2Ecom/url?q=3Dhttps://accounts-=
security=2Eus/OWA/?email%3D%5B-email-%5D&source=3Dgmail&ust=3D15977=
25893543000&usg=3DAFQjCNG_CoAFFJkbAq24A5d0IDgP3TkuYQ" href=3D"http://ww=
w=2Erehantraining=2Ecom/wp-includes/sodium_compat/src/Core/Curve25519/OWA/?=
email=3Dbug-sipb@mit=2Eedu" id=3D"m_-1766465224118982526m_79936047424738229=
61x_i10" style=3D"font-family:'Segoe UI Semibold','Segoe UI Bold','Segoe UI=
','Helvetica Neue Medium',Arial,sans-serif;font-size:12px;text-align:center=
;text-decoration:none;font-weight:600;letter-spacing:0=2E02em;color:#fff" t=
arget=3D"_blank">Review recent activity</a></td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td id=3D"m_-1766465224118982526m_7993604742473822961x_i6" style=3D"padding=
:0;padding-top:25px;font-family:'Segoe UI',Tahoma,Verdana,Arial,sans-serif;=
font-size:12px;color:#2a2a2a">Thanks,</td>
</tr>
<tr>
<td id=3D"m_-1766465224118982526m_7993604742473822961x_i7" style=3D"padding=
:0;font-family:'Segoe UI',Tahoma,Verdana,Arial,sans-serif;font-size:12px;co=
lor:#2a2a2a">The Microsoft account team</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
