Microsft Azure IP checking tool ? - safe or hacker

Question

Microsft Azure IP checking tool ? - safe or hacker

John Coates 20

How can I check an IP detailed as Azure related is safe and legitimate or a hacker using Azure infrastructure?

Accepted answer

0 additional answers

Your answer

Answer 1

KapilAnanth-MSFT 49,536 Microsoft Employee Moderator

@John Coates

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know if there are any tools to identify if an Azure IP is legitimate.

To verify if an IP belongs to Azure or not, you can use Azure IP Lookup tool.

If you use this, you will get the region and the type of the resource using the IP.

AzureCloud.<RegionName> - Indicates that the IP can belong to a VM or an IaaS Service
<PaaSService>.<RegionName> - Indicates that the IP belongs to a PaaS Service. E.g., Storage.CentralIndia

The chances that the latter is malicious is highly unlikely.

However, with the former, it is quite possible that a user is abusing the Azure platform.

There are no websites/tools to check if a specific Azure IP is being used by a hacker directly as Azure IP is just like any other Public IP in Internet.
However, if you have an Azure environment and if you can specify your exact use case , we can suggest how you can prevent your environment from such malicious IPs/attacks.

Additionally, you can use Microsift's IP Reporting tool to report an Azure IP should you feel the IP is being abused.

In case someone has reported the Azure IP, Microsoft will take the necessary action from the backend.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

John Coates 20

if I look at one of the IP addresses that have shown up in our security solution, and put this detail into the services you have provided, I get the folowing,

[{"serviceTagId":"AzureCloud.uksouth","ipAddress":"20.68.13.194","ipAddressPrefix":"20.68.0.0/18","region":"uksouth","regionId":"27","systemService":"","networkFeatures":"API NSG"},{"serviceTagId":"AzureCloud","ipAddress":"20.68.13.194","ipAddressPrefix":"20.68.0.0/18","region":"","regionId":"0","systemService":"","networkFeatures":"API NSG"}]

What does this translate to?

KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2023-11-22T17:40:03.37+00:00

@John Coates

This means the IP address belongs to Azure.

Should you feel this is being abused, you should report it in Microsift's IP Reporting tool as mentioned above.

Cheers,

Kapil.
John Coates 20 Reputation points

2023-11-23T08:37:55.86+00:00

I can see textually that it is Azure related, I would have liked to understand whether the IP is related to 365 Azure products and services we are leveraging with Microsoft, or whether it is an Azure service being used by a non-Microsoft entity for potentially malicious intent.
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2023-11-23T09:44:45.6866667+00:00

@John Coates

O365 and Azure are two different services from Microsoft.

From the tool, you can only check IP Addresses from Azure.

Per the result, it is definitely being used by a third party leveraging Azure.

However, I am afraid we will be only able to understand if the intent was malicious or not by verifying the pattern in logs and understanding why it would interact with your service to begin with.

Again, any customer can deploy any service in Azure and this IP could be assigned to the service deployed.

Cheers,

Kapil
John Coates 20 Reputation points

2023-11-23T10:13:08.9233333+00:00

ok, appreciate the info and effort, if we see anymore traffic touching services, we will just test using the reporting tool.

Thanks.

John.

Share via

Microsft Azure IP checking tool ? - safe or hacker

0 additional answers

Your answer