I use RDPGuard on my webserver. I have noticed that it blocked an IP address which seemed to originate from a Microsoft registered IP address:
Process Information: Caller Process ID: 0xf78 Caller Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: BLAH Source Network Address: 220.127.116.11 Source Port: 36038
Looking at the rdpguard whois service I can see that this is a Microsoft IP:
WHOIS Source: ARIN IP Address: 18.104.22.168 Country: USA - Washington Network Name: MSFT-EP Owner Name: Microsoft Corp From IP: 22.214.171.124 To IP: 126.96.36.199 Allocated: Yes Contact Name: Microsoft Corp Address: One Microsoft Way, Redmond Email: email@example.com Abuse Email: firstname.lastname@example.org Phone: +1-425-882-8080 http://rdpguard.com/free-whois.aspx?src=app&v=1-2-5&fam=x64&affid=self&ip=188.8.131.52
Has anybody seen this before? Does anybody know why this would have happened?