What Should I Do When I Receive a Remote Login Notification from Huawei Cloud?

Symptom

You received a remote login notification on your mobile phone or in your email.

Possible Causes

• When you or your IAM users log in to Huawei Cloud, Huawei Cloud detects that the IP address of a login is different from the usual IP address.
• The IP address library used by Huawei Cloud may contain incorrect locations of some IP addresses. If the alarm is a false positive, you can submit a service ticket to report the location and IP address. We will correct the IP address library based on your feedback.

Solutions

• Go to the Cloud Trace Service (CTS) console to view the detailed login audit logs. You can search for login events on the event list page.
  

  You need to check the login logs, including the login time, IP address, and whether the operation is performed by you or authorized by you.

• Check whether the login IP address is the egress IP address you are using. If the login IP address is not your egress IP address and the login is not authorized by you, your password may have been disclosed. You need to change your password. You are advised to bind a virtual MFA device or security key, and enable login protection and operation protection. You and your IAM users will need to pass secondary authentication when logging in to the console or performing high-risk operations on the console.
• After changing the password and enabling login protection and operation protection, you are advised to view detailed operation audit logs on the Cloud Trace Service (CTS) console, including but not limited to account resource status, and whether critical operations are performed by unauthorized users.