I use RDPGuard on my webserver. I have noticed that it blocked an IP address which seemed to originate from a Microsoft registered IP address:
Process Information: Caller Process ID: 0xf78 Caller Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: BLAH Source Network Address: 188.8.131.52 Source Port: 36038
Looking at the rdpguard whois service I can see that this is a Microsoft IP:
WHOIS Source: ARIN IP Address: 184.108.40.206 Country: USA - Washington Network Name: MSFT-EP Owner Name: Microsoft Corp From IP: 220.127.116.11 To IP: 18.104.22.168 Allocated: Yes Contact Name: Microsoft Corp Address: One Microsoft Way, Redmond Email: email@example.com Abuse Email: firstname.lastname@example.org Phone: +1-425-882-8080 http://rdpguard.com/free-whois.aspx?src=app&v=1-2-5&fam=x64&affid=self&ip=22.214.171.124
Has anybody seen this before? Does anybody know why this would have happened?