Strange attempts from Azure IP on our client data

Question

I had to put this case here as Microsoft's answer won't make sense. What's been happening is that since early July this year, we've had this IP belonged to Microsoft's Azure infrastructure, 104.42.198.99, being flagged in Cloudflare firewall events due to its false user agents, IE6, used when trying to access our clients' sensitive data. I contacted Azure support and Microsoft Computer Emergency Response team relating to this IP and was told that the IP belongs to Azure infrastructure and it's a standard function of Windows Defender SmartScreen.

Found out this IP's in the blocked list in certain sites such as this one - https://www.abuseat.org/lookup.cgi

Although I blocked this IP address within the Cloudflare, an attempt to access our clients' data is still happening on a daily basis and I'm stuck on where to go from here to find out what's really going on. Some of the URL that this IP was trying to get to was restricted to our office network IP range adding more confusion.

Any help or point to a right direction would be very much appreciated.

Thanks.

Answer 1

Please contact this guy

If you need his name, register to https://censys.io/ and whois the ip.

This person is the one in charge (for abuse) of the following ASN: MICROSOFT-CORP-MSN-AS-BLOCK AS8068

The ip you stated seems to be pretty well known for misbehaving. Try to figure out if microsoft is not playing by the rules or if its an attack attempt performed by a tier.

And mention the fact that the IP have fallen into a sinkhole. Since recent botnet's CnC server(s) use Domain Generation Algorithm, mentioning CnC server past domain name wont be very relevant.

Answer 2

I think I know what happened. I got to this page while googling for the IP 104.42.198.99 after suspected activity was detected on one of my servers and realizing that the IP address belongs to Microsoft. Then I started to put the pieces together and came to a conclusion.

Here's what happened in my case: Using a recently installed Windows 10 machine, the user opened Edge broswer and downloaded 1 particular file from one of my servers at 2 AM. About 8 Hours later the IP address from Microsoft Data Center downloaded the very same file - 1 Hit, fake user-agent string (announcing IE 6.0 on Windows XP). No more hits on the previous or following days. This leads me to believe it was related to the earlier 2 AM download.

Joining this with Microsoft's answer to you, my guess is that Windows Defender SmartScreen uses a cloud system to protect the machines it's running on. So, the user downloads an .exe file on a W10 machine, SmartScreent will alert about the potential danger but allow the user to open it anyway, and notifies the cloud about this URL for posterior analisys. The "suspicious" URL will then stay on the download queue until it's turn to be analyzed. Microsoft's server will then retrieve the file given by the URL and process it for potential threats, then it will probably add the information to a catalog, mark the url and/or the file as safe/unsafe/unknown to speed up future uses (allow/blocking) of the URL/file by other W10 users around the world.

So, in conclusion, Windows 10/Microsoft Servers check everything one downloads and opens on their computer, in the name of safety (who cares about privacy, right?). Nonetheless, and other than privacy concerns, it seems like a harmless activity from that IP.

On the positive side, it looks like MS finally woke up to serious security trying to antecipate and be quick to respond to malware threats when necessary. Is it the best way to do it? Thats a question for debate.