It may be reassuring to remember that a login attempt that says FAILED means that your account was not accessed. However, it understandably might still be alarming or confusing to see failed login attempts on your account.
Below are some common scenarios that might explain failed suspicious logins. If you're concerned about successful suspicious logins, we recommend reading more about what to do if you think your account has been compromised.
There are attempted logins from other locations
Attempted logins from other cities or countries can indicate that a spammer has found your email address and tried to access your account. Since the attempt failed, this means that they used an old or incorrect password.
If you're concerned about how a spammer found your email address, please note that it's common for spammers to obtain lists of email addresses and passwords through data breaches at services such as online stores, concert ticket vendors, and so on. Other sites often don’t have the same high security measures as Fastmail, which makes those sites much easier for criminals to break into. If a service you've used in the past (outside of Fastmail) has been breached or compromised in some way, it's possible for your email and password combination for that service to get dumped in a list somewhere on the internet. (This is why it's so important to have a different password for each service you use.)
Haveibeenpwned is a tool that will tell you if an email address has been compromised in a data breach or placed on a spamming list. Enter your commonly used email addresses and the tool will return a list of any breaches or spam lists the email address appears in.
If you're using a Fastmail domain, it's also possible that someone with a similar username could have mistyped their address while logging in.
There are attempted logins at times where I was not using my account. Was someone using my device?
Check if the login says IMAP on the left side. If so, this means that the "login" was a connection through a program using IMAP, such as an email app (Mail, Spark, etc.) or an email client (Outlook, Thunderbird, Mac Mail, etc.). Most likely, an IMAP login at an unexpected time shows that a mail client/app you use was connecting to the server to see if you received new mail.