Not Monitored
Tag not monitored by Microsoft.
39,335 questions
Attack from Microsoft Azure IPs
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 47%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
Artem Smith
0
Reputation points
Hello,
I have a bunch of servers on linode and all sites/servers are constantly under attack from different Microsoft Azure IPs. How to prevent this ?
Here is a list of IPs I blocked today:
52.138.181.236 52.169.14.240 40.126.235.214
52.138.181.236 - - [23/Sep/2024:10:08:52 +0000] "GET /makeasmtp.php?password-protected=login&redirect_to=http%3A%2F%2Ftheelegancepartyrental.com%2Fmakeasmtp.php HTTP/1.1" 404 4773 "-" "-"
52.138.181.236 - - [23/Sep/2024:10:08:54 +0000] "GET /wp-sigunq.php?password-protected=login&redirect_to=http%3A%2F%2Ftheelegancepartyrental.com%2Fwp-sigunq.php HTTP/1.1" 404 4773 "-" "-"
52.138.181.236 - - [23/Sep/2024:10:08:56 +0000] "GET /wso112233.php?password-protected=login&redirect_to=http%3A%2F%2Ftheelegancepartyrental.com%2Fwso112233.php HTTP/1.1" 404 4773 "-" "-"
52.138.181.236 - - [23/Sep/2024:10:08:58 +0000] "GET /alfanew.php?password-protected=login&redirect_to=http%3A%2F%2Ftheelegancepartyrental.com%2Falfanew.php HTTP/1.1" 404 4767 "-" "-"
52.138.181.236 - - [23/Sep/2024:10:09:01 +0000] "GET /fw.php?password-protected=login&redirect_to=http%3A%2F%2Ftheelegancepartyrental.com%2Ffw.php HTTP/1.1" 404 4752 "-" "-"
52.138.181.236 - - [23/Sep/2024:10:09:03 +0000] "GET /install.php?password-protected=login&redirect_to=http%3A%2F%2Ftheelegancepartyrental.com%2Finstall.php HTTP/1.1" 404 4767 "-" "-"
52.138.181.236 - - [23/Sep/2024:10:09:05 +0000] "GET /wp-login.php HTTP/1.1" 200 5940 "-" "-"
52.138.181.236 - - [23/Sep/2024:10:09:07 +0000] "GET /wp-content/plugins/google-seo-rank/module.php?password-protected=login&redirect_to=http%3A%2F%2Ftheelegancepartyrental.com%2Fwp-content%2Fplugins%2Fgoogle-seo-rank%2Fmodule.php HTTP/1.1" 404 4875 "-" "-"
52.138.181.236 - - [23/Sep/2024:10:09:09 +0000] "GET /chosen.php?password-protected=login&redirect_to=http%3A%2F%2Ftheelegancepartyrental.com%2Fchosen.php HTTP/1.1" 404 4764 "-" "-"
52.138.181.236 - - [23/Sep/2024:10:09:11 +0000] "GET /simple.php?password-protected=login&redirect_to=http%3A%2F%2Ftheelegancepartyrental.com%2Fsimple.php HTTP/1.1" 404 4764 "-" "-"
52.169.14.240 - - [23/Sep/2024:10:26:20 +0000] "GET /wp-activate.php HTTP/1.1" 302 - "-" "-"
52.169.14.240 - - [23/Sep/2024:10:26:23 +0000] "GET /wp-login.php?action=register HTTP/1.1" 302 - "-" "-"
52.169.14.240 - - [23/Sep/2024:10:26:29 +0000] "GET /wp-login.php?registration=disabled HTTP/1.1" 200 5946 "-" "-"
52.169.14.240 - - [23/Sep/2024:10:26:35 +0000] "GET /plugins.php HTTP/1.1" 302 - "-" "-"
52.169.14.240 - - [23/Sep/2024:10:26:42 +0000] "GET /plugins.php?password-protected=login&redirect_to=https%3A%2F%2Fprojectufirst.website%2Fplugins.php HTTP/1.1" 404 3686 "-" "-"
52.169.14.240 - - [23/Sep/2024:10:26:49 +0000] "GET /post.php HTTP/1.1" 302 - "-" "-"
52.169.14.240 - - [23/Sep/2024:10:26:56 +0000] "GET /post.php?password-protected=login&redirect_to=https%3A%2F%2Fprojectufirst.website%2Fpost.php HTTP/1.1" 404 3677 "-" "-"
52.169.14.240 - - [23/Sep/2024:10:27:02 +0000] "GET /admin.php HTTP/1.1" 302 - "-" "-"
52.169.14.240 - - [23/Sep/2024:10:27:07 +0000] "GET /admin.php?password-protected=login&redirect_to=https%3A%2F%2Fprojectufirst.website%2Fadmin.php HTTP/1.1" 404 3680 "-" "-"
52.169.14.240 - - [23/Sep/2024:10:27:12 +0000] "GET /about.php HTTP/1.1" 302 - "-" "-"
40.126.235.214 - - [23/Sep/2024:10:28:44 +0000] "GET /lock.php HTTP/1.1" 404 150440 "-" "-"
40.126.235.214 - - [23/Sep/2024:10:28:45 +0000] "GET /add_class.php HTTP/1.1" 404 150445 "-" "-"
40.126.235.214 - - [23/Sep/2024:10:28:47 +0000] "GET /inputs.php HTTP/1.1" 404 150442 "-" "-"
40.126.235.214 - - [23/Sep/2024:10:28:48 +0000] "GET /contact.php HTTP/1.1" 404 150443 "-" "-"
Why is this happening ?
{count} votes
-
KapilAnanth-MSFT 46,016 Reputation points Microsoft Employee2024-09-23T13:14:26.48+00:00 Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
From your verbatim, it appears you are not using any Azure service.
Please note Azure DDOS is used to protect Services hosted in Azure.
If I have misunderstood and you are owning servers in Azure, please let us know.
If you feel that Microsoft IPs are being abused, you can Report it here: https://msrc.microsoft.com/report/
Cheers,
Kapil
-
Artem Smith 0 Reputation points
2024-09-24T16:48:45.7433333+00:00 Hi KapilAnanth-MSFT. You definitely misunderstood the question.
The things is that I've been attacked by somebody from Microsoft Azure servers.
I've written an email to abuse@microsoft.com but it is like a black whole. No response from there.
So I think the only solution is to block all MS Azure IPs. Do you know any place where I can find all MS Azure gateway IPs so I may block them ? Or maybe by AS number ?
Thanks.
-
KapilAnanth-MSFT 46,016 Reputation points Microsoft Employee
2024-09-24T17:30:47.2866667+00:00 @Artem Smith , I understand that you do not own any Azure services yourself.
From your logs, you are concluding that you are being attacked by IPs belonging to Azure.
Azure VMs and other services are used by millions of users and across various regions.
Without you having an Azure subscription, we will not be able to assist you with any configuration/features.
You can find a list of all Azure IPs here: Azure IP Ranges and Service Tags – Public Cloud
Under the tag, "AzureCloud".
More details on Azure IP Ranges can be found on Azure service tags
Cheers,
Kapil
Sign in to comment
Sign in to answer