Hacking by Microsoft!

Customer Support Customer Only Discussion
1

I got a bunch of responses from a site on win38 this morning, password requests and the like, set off by a bot crawling the site apparently trying hard to hack it, but the logs show the IP as a Microsoft one! The CP doesn’t allow me to block it, either. I assume this is a security test of some sort?

Typical log entry:
2013-09-27 06:56:09 138.91.168.197 - W3SVC500 CL1-WIN38 173.0.143.127 80 GET /news/2010/06/2010’ and 5=5 and ‘41’='41-achs-annual-council-meeting.html - 404 0 5516 409 1 HTTP/1.1 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/5.0) ASPSESSIONIDCSBADDSR=AJCCLHICKJLEKDPCBANPLNJF http://www.achs …

2

That is a windows azure IP range just FYI. Yep its crawling for exploits.

3

Oh and probably an exploited windows azure machine itself. I will note that Azure doesn’t even give IPs with their machines but port maps, so many Virtual Machines may share the same outgoing IP address. Can be messy…