Apple ID sign-in attempts

Lately, I have been repeatedly getting notifications in the middle of my iPad/Phone screen: “Your Apple ID was used to sign in to a device in <foreign country>. Allow/Don’t allow”. I have been clicking on “Don’t allow”. Then it asks if I would like to change my password. I did change my password — NOT by clicking on that box — and set up 2-step verification. Is this a legitimate notification from Apple, or a fake phishing attempt? Is there anything I can do to stop it?