Should I be concerned?

[fivealive]

I was updating my Hotmail security information, when I noticed the area for recent login activity, and I noticed going back to last month on the 10, their have been 2 attempts to log in to my Hotmail almost daily, the seemed to have stopped by the 18 then started up again yesterday , they all failed with wrong password,



My question is their anything I should be doing,

[exile360]

You should be OK as long as you have a strong password, but do remember to periodically change all passwords to be on the safe side.

[fivealive]

OK, I have two tiered authentication turned on.

No attempts on any of my other accounts for anything else,

[John L. Galt]

You might also look into seeing if you have a mobile device trying to connect to your account.

[fivealive]

These attempts are from all over the world, no where near Canada, which is where  Live. I am actually only logged in on 2 devices, my tablet and my laptop, both of which are logged in via the web browser.

[David H. Lipman]

Then you can presume that it is more or less a probing attack.  A preemptive action would be to change your password making sure it is a Strong Password.

[fivealive]

Then you can presume that it is more or less a probing attack.  A preemptive action would be to change your password making sure it is a Strong Password.

I would say my passwords are pretty strong, keep them at the character limit for the sites, and they all different, what I don't get is why they would continue to probe for months, on top of that even if they somehow where able to guess my password, they still wouldn't be able to get in.

[David H. Lipman]

Such is the world we live in... 

[fivealive]

Such is the world we live in... 

I also try and change my passwords every few months or so, Biggest problem I have is keeping track of them all, or worst remembering what password is for what.

[AdvancedSetup]

I have probably over 1,800 passwords and don't forget any of them.

 

KeePass Password Safe

 

Great product.

[John L. Galt]

100% agreed - I love KeePass.

 

I have around 1400 myself, but I also include product keys, SSL certificates (since you can attach actual files into the database), configuration files, exported .reg entries, and numerous other things.

 

My entire (now defunct) M$ Technet product key listing is in there....every key I ever redeemed through TechNet, and I joined when there were still 10 licenses per product (other than Terminal Services products)....

 

Using plugins, you can even setup TOTP (Time-based One Time passwords) which is the basis for more than a few TFA (Two Factor Authentication), plus plugins for many other purposes - my favorite one is the favicon downloader, which allows you to download the website's favicon if you add a URL to a particular entry (not 100% perfect, but works for about 90% of my entries).

 

OK, off my KP soapbox lol...

 

As to the probing attempts, since it is not you, yeah, I'd keep a close eye on you account - if it happens twice a day like clockwork, and shows from all different locations, sounds like a bot -net trying to hack your account, and only twice a day means that it is probably set so that it does not set off the account lockout procedure.

[blackdove83]

If everyone checked theyd probably find the same thing with attempts from all over the world. Ive got some from really bizarre places.

[blackdove83]

Cant edit. Grrr. I noticed that its always one attempt from someplace.

Anyone know if these are automated attacks? Attempts to hijack accounts to send spam? To get financial info?

[fivealive]

even if they get the correct password, it requires a second password be typed in, that is sent to my cell, I would know instantly something was up if I got that.

 

 

Also, what is really weird is if you click on the failed attempt in the recent activity, it lists the ip address as well as device type and browser app type, the weird part being the device type is listed as unknown and so is the browser/app.

[John L. Galt]

Yes, it is most likely an attempt to hijack an email account so that it can attempt to glean information on the account owner to attempt to hijack their PC and make it a part of hte bot-net, as well as an attempt to self-propagate the bot-net by sending infected emails to everyone in your contact list.

 

As for device and browser type being unknown, not really surprising, as it is more than likely a generated script that is being run automatically (or on a schedule) in not only your but potentially thousands of other email addresses worldwide.

 

And I regularly check for my attempts on all my accounts as well - and I do not have anything like this on any of my accounts.

[fivealive]

I check my other accounts for that stuff regularly as well, but I just learned that hotmail has this, I will point out about 7 years ago my computer got infected and this email address was used to send spam, I found out in seconds of the emails going out that it was happening, and unplugged the computer from the net, and went on a clean one and changed passwords, then formatted the computer,

[Amethyst]

I have a hotmail account that I use for message boards and such--an account I can delete if I need to.  This thread got me checking, and I see that there have been three failed attempts to log into my hotmail e-mail account.  One was from Venezuela, one from Argentina, and one from the west coast in the U.S.  Like you, Fivealive, the ip addresses were listed but device and browser unknown. My laptop is trusted so it doesn't require the 2 step verification, but my other devices do.  

 

Quite troubling, really.  I mean, the attempts were unsuccessful and my password is so random as to be very difficult, if not impossible, to guess.  But still...I am really sick of all the cyber crime crap. 

[John L. Galt]

If only more people would enable and start using Two Factor Authorization (aka Two Step verification) methods.  Life would be a lot simpler.

[fivealive]

If only more people would enable and start using Two Factor Authorization (aka Two Step verification) methods. Life would be a lot simpler.

Agreed, personally if the option is available I use it, no exceptions.

[fivealive]

2 more attempts this morning and this afternoon, does sound like its a botnet running, you would think the owners would check on it and see they aint getting in and would stop.

[John L. Galt]

No, that is their modus operandi.  They will continue to do so, using brute force attacks, until they get in - and think about it - they are limited to doing 2 attacks per day on your system - and if each attack takes, on average, 50  milliseconds to execute and another 50 milliseconds to get a response, then both attacks take 200 milliseconds. that allows them to attack 432000 email addresses per day.  And if that is one machine conducting all of those attacks, and you have 1000 machines running on the bot-net, then you have 432000000 email address attacks that can be performed each day.

[blackdove83]

Are there multiple repeated attempts from same ip or region?

[fivealive]

I haven't compared the IP addresses at all, but the attacks are from all over the place,

 

 

EDIT:

 

I just checked the ip addresses, and even with the ones from the same country, the ip is different.

[John L. Galt]

Again, they're probably using some sort of proxy in order to prevent tracebacks.

 

Does your email system allow for reporting those unauthorized login attempts?

[Amethyst]

I'm not trying to hijack this thread, but I looked up the three failed login attempts on my hotmail account at AbuseIPDB dot com.  One of the failed attempts came from Microsoft!  This website said the IP address I was checking was from a 'trusted hosting ISP' and could not be reported.  That was the U.S. IP.  I reported the 2 South American IP's, and I am the first person to do so.  

 

Hotmail doesn't seem to allow for reporting unless the hacker actually succeeds in logging in, then there is a 'not you?' button you can click in that case.