Home / server / Questions / 599009
Accepted
Simon
Asked: 2014-05-28 23:05:56 +0800 CST

Is Microsoft trying to hack my mail server?

  • 772

Since yesterday I have countless lines of these¹ in my logs. A whois on the IP shows

$ whois 23.97.134.64

...

NetRange:       23.96.0.0 - 23.103.255.255
CIDR:           23.96.0.0/13
OriginAS:       AS8075
NetName:        MSFT
NetHandle:      NET-23-96-0-0-1
Parent:         NET-23-0-0-0-0
NetType:        Direct Assignment
RegDate:        2013-06-18
Updated:        2013-06-18
Ref:            http://whois.arin.net/rest/net/NET-23-96-0-0-1


OrgName:        Microsoft Corporation
OrgId:          MSFT
Address:        One Microsoft Way
City:           Redmond
StateProv:      WA
PostalCode:     98052
Country:        US
RegDate:        1998-07-10
Updated:        2013-08-21
...

is Microsoft trying to hack my mailserver?

¹

May 27 19:24:33 31337 postfix/smtps/smtpd[20048]: warning: unknown[23.97.134.64]: SASL LOGIN authentication failed: authentication failure
May 27 19:24:59 31337 postfix/smtps/smtpd[20048]: warning: unknown[23.97.216.188]: SASL LOGIN authentication failed: authentication failure
May 27 19:25:00 31337 postfix/smtps/smtpd[20064]: warning: unknown[23.97.134.64]: SASL LOGIN authentication failed: authentication failure
May 27 19:25:26 31337 postfix/smtps/smtpd[20048]: warning: unknown[23.97.134.64]: SASL LOGIN authentication failed: authentication failure
May 27 19:25:50 31337 postfix/smtps/smtpd[20064]: warning: unknown[23.97.134.64]: SASL LOGIN authentication failed: authentication failure
May 27 19:25:52 31337 postfix/smtps/smtpd[20048]: warning: unknown[23.97.216.188]: SASL LOGIN authentication failed: authentication failure
....
May 28 09:00:19 31337 postfix/smtps/smtpd[30240]: warning: unknown[23.97.134.64]: SASL LOGIN authentication failed: authentication failure
May 28 09:00:52 31337 postfix/smtps/smtpd[30240]: warning: unknown[23.97.134.64]: SASL LOGIN authentication failed: authentication failure
May 28 09:01:17 31337 postfix/smtps/smtpd[30240]: warning: unknown[23.97.134.64]: SASL LOGIN authentication failed: authentication failure
May 28 09:04:42 31337 postfix/smtps/smtpd[30240]: connect from unknown[23.97.134.64]
May 28 09:04:46 31337 postfix/smtps/smtpd[30240]: warning: unknown[23.97.134.64]: SASL LOGIN authentication failed: authentication failure
May 28 09:04:48 31337 postfix/smtps/smtpd[30240]: lost connection after AUTH from unknown[23.97.134.64]
May 28 09:04:48 31337 postfix/smtps/smtpd[30240]: disconnect from unknown[23.97.134.64]
email-server

1 Answers

  1. Best Answer

    If by "Microsoft" you mean some guy who rented a Azure VM: then maybe.
    This range does belong to Microsoft and is used by Azure (see: http://www.microsoft.com/en-us/download/details.aspx?id=41653).
    So this could be pretty much anyone.

    You may want to contact Microsofts abuse department.
    Or ignore it like the rest of the background noise you get on public services.

    • 2