I checked out my old Hotmail account and there’s somebody in china trying to access it non stop.

It’s protected with a strong password and 2fa. But it still makes me uneasy. I just wish I could geo block the attempts or something.

I saw that this morning from 6AM to 1:30PM had people from IPs all over Europe trying to login. Failing luckily but I'm glad to see I'm not the only one.

Actually after looking at the logs it non-stop every hour for days and days. Odd that I only got like 7 emails about the code this morning and not the thousands of other times.

It’s good to be paranoid, but for years I have had periodic sign-ups for lists I never wanted, services I never asked for, medical appointments and plane ticket reservations(!) I didn’t make … you name it.

All because I was an early gmail invitee, so my account is just ‘[email protected]’ (with no ‘123’, or other decorations) – I was the FIRST. And I’ll be damned if I give it up!

So, so many people with my first initial and surname forget to add whatever crap they added to their signup after they must have gotten the error message at sign-up that told them ‘sorry, but [email protected] is already taken’ and they then forget whatever they added, and keep using my email address when they register for whatever crap they do. So bloody annoying.

I’ve taken to just logging into the numerous sites they helpfully send me registration links for, and if there’s a profile section I may (if I’m feeling cranky) set their profile photo and bio to unsavoury things, before locking the account. If I’m not feeling cranky I just unsubscribe/delete the account.

This is normal. All of my accounts have looked like this for years. So I imagine every account with Microsoft will see this bombardment of someone trying to get in.

It’s not just Microsoft - every server on the internet with an open port gets bombarded all of the time. It’s just the way of the internet. So if you move your account to another platform it’ll see the same bombardment as it does now.

I have the same issue. For me it’s mainly some ip address in Russia but it bounces around. I’ve had the 2FA enabled on my account for at least a year now. I have a unique, random password for it. Recently the 2FA app popped up with a message to click on the number to verify or deny. I knew it wasn’t me so I denied it.

I was worried someone had managed to guess my long ass password but I fiddled around with it and it’s possible to get that 2FA prompt when you are trying to do a password recovery. So I just let it ago and haven’t gotten any others since. I still feel like I should chang my email but based on what others are saying it doesn’t seem like it will make a difference.

I’ve been getting in the habit of using per service emails and rotating them like my passwords (if the service allows). MS allows this (assuming the account is not for your email). I’ve changed it 5-6 times. Except for Skype which I don’t use. Can’t seem to change that one myself.

Others mentioned YubiKey. Another alternative I use is both an OnlyPass and Mooltipass, interchangeably. They act as keyboards and work with any device I’ve tried that supports USB keyboards without some agent always running. With it I’ll add an extra 56 random characters on top of my memorized passphrase for critical systems (disk encryption, system login, password manager).