Failed RDP brute force attack from Microsoft IP address?

Question

I use RDPGuard on my webserver. I have noticed that it blocked an IP address which seemed to originate from a Microsoft registered IP address:

Process Information:
Caller Process ID:  0xf78
Caller Process Name:    C:\Windows\System32\winlogon.exe

Network Information:
Workstation Name:   BLAH
Source Network Address: 168.62.177.31
Source Port:        36038

Looking at the rdpguard whois service I can see that this is a Microsoft IP:

WHOIS Source:      ARIN
IP Address:        168.62.177.31
Country:           USA - Washington
Network Name:      MSFT-EP
Owner Name:        Microsoft Corp
From IP:           168.61.0.0
To IP:             168.63.255.255
Allocated:         Yes
Contact Name:      Microsoft Corp
Address:           One Microsoft Way, Redmond
Email:             [email protected]
Abuse Email:       [email protected]
Phone:             +1-425-882-8080 

http://rdpguard.com/free-whois.aspx?src=app&v=1-2-5&fam=x64&affid=self&ip=168.62.177.31

Has anybody seen this before? Does anybody know why this would have happened?

Answer 1

As SteveS points out below, it is possible that this is a misbehaving Azure server. Azure is a cloud server platform that Microsoft runs. This would also mean that you should really contact the two e-mails on the reverse look-up record. Microsoft would want to know about it whether it is Azure being abused or one of the other problems I originally mentioned.

The only thing that comes to mind is that if the packet that is sent to RDP is significantly shorter than the packet that the RDP server responds with, it is possible this is a ping of death style DOS attack being carried out against Microsoft. Basically the principal is that the attacker makes a small falsified request to one server to get that server to respond to the target with a much larger amount of information. The original ping of death was setting up two servers so that they would constantly interpret the response as a request and respond, which made an infinite loop that would bring one or both victim servers down. There likely isn't a loop condition here, but it is at least one possibility.

That or Microsoft actually has a compromised system in their network and is being used as a bot, which is also entirely possible.

I'm not aware of any general, legit reason why Microsoft would be trying to connect to your RDP. I'd recommend contacting the abuse or iprrms addresses and see what they say.

Answer 2

Sometimes, whois tools do not tell you the real information of IP addresses. Most Windows servers suffers RDP brute force attacks. One of my servers gets about 10 RDP attacks every day, even it is only a test server and there is no applications run on that server. I use anti ddos guardian instead, which stops RDP attacks and slow http ddos attacks.