I use RDPGuard on my webserver. I have noticed that it blocked an IP address which seemed to originate from a Microsoft registered IP address:

Process Information:
Caller Process ID:  0xf78
Caller Process Name:    C:\Windows\System32\winlogon.exe

Network Information:
Workstation Name:   BLAH
Source Network Address:
Source Port:        36038

Looking at the rdpguard whois service I can see that this is a Microsoft IP:

WHOIS Source:      ARIN
IP Address:
Country:           USA - Washington
Network Name:      MSFT-EP
Owner Name:        Microsoft Corp
From IP: 
To IP:   
Allocated:         Yes
Contact Name:      Microsoft Corp
Address:           One Microsoft Way, Redmond
Email:             [email protected]
Abuse Email:       [email protected]
Phone:             +1-425-882-8080 


Has anybody seen this before? Does anybody know why this would have happened?

2 Answers 2


As SteveS points out below, it is possible that this is a misbehaving Azure server. Azure is a cloud server platform that Microsoft runs. This would also mean that you should really contact the two e-mails on the reverse look-up record. Microsoft would want to know about it whether it is Azure being abused or one of the other problems I originally mentioned.

The only thing that comes to mind is that if the packet that is sent to RDP is significantly shorter than the packet that the RDP server responds with, it is possible this is a ping of death style DOS attack being carried out against Microsoft. Basically the principal is that the attacker makes a small falsified request to one server to get that server to respond to the target with a much larger amount of information. The original ping of death was setting up two servers so that they would constantly interpret the response as a request and respond, which made an infinite loop that would bring one or both victim servers down. There likely isn't a loop condition here, but it is at least one possibility.

That or Microsoft actually has a compromised system in their network and is being used as a bot, which is also entirely possible.

I'm not aware of any general, legit reason why Microsoft would be trying to connect to your RDP. I'd recommend contacting the abuse or iprrms addresses and see what they say.

  • 2
    I don't know if the IP range fits, but it could also be coming from a Windows Azure host used for attacks/scanning.
    – Steve
    Jan 4, 2013 at 18:06
  • 1
    I think @SteveS has the right answer. I have an Azure server which is also in the 168.62.* range, so it's definitely possible your attacker was using an Azure server, hence the IP. Jan 4, 2013 at 18:18
  • @SteveS - I updated my answer to include your idea and explain a little about what Azure is and what to do if that is the case. I'm guessing that is the most likely too as the other scenarios are fairly unlikely in comparison. Jan 4, 2013 at 18:51

Sometimes, whois tools do not tell you the real information of IP addresses. Most Windows servers suffers RDP brute force attacks. One of my servers gets about 10 RDP attacks every day, even it is only a test server and there is no applications run on that server. I use anti ddos guardian instead, which stops RDP attacks and slow http ddos attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .