I had a security engineer analyze a packet capture from my machine.
About five IPs were used in an attack. It was the only IP (6) that was detected multiple times by VirusTotal.
The IP is 184.108.40.206. Four months ago, this IP was a Microsoft update site. This engineer said this is a fake Microsoft site. Of course, he also knows that the IP is CDN.
Another engineer says this is the official Microsoft site. When I run Windows Update, the packet capture showed the 220.127.116.11.
Is it possible for a hacker to hide behind a CDN called 18.104.22.168, spoof and attack?