It could be the outlook/Acompli app infrastructure which is now hosted in Azure. The What specific IPs are you seeing?
-David -----Original Message----- From: mailop <mailop-boun...@mailop.org> On Behalf Of Brotman, Alexander Sent: Friday, February 9, 2018 8:00 AM To: Dan Malm <d...@one.com>; mailop@mailop.org Subject: Re: [mailop] Extreme amounts of SMTP auth from microsoft/outlook IPs Not sure if I'd call it extreme, but a marked increase beginning Feb 6th. -- Alex Brotman Sr. Engineer, Anti-Abuse Comcast -----Original Message----- From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Dan Malm Sent: Friday, February 09, 2018 3:57 AM To: mailop@mailop.org Subject: [mailop] Extreme amounts of SMTP auth from microsoft/outlook IPs Hi I'm seeing an extreme amount of SMTP authentications (over 600/s) from the microsoft owned 40.101.0.0/16 range on my customer SMTP servers. It's just auth, with valid credentials, and then it disconnects right after so no attempts to send any mails have been done for the vast majority of these connections. A small amount of valid mails are being sent from this range though. HELO indicates it's from outlook.com. So seems like their system for sending with your own domain through external servers has gone a bit haywire... I've sent ab...@microsoft.com a mail about it, but I'm a bit curious if anyone else is seeing the same? -- BR/Mvh. Dan Malm, Systems Engineer, One.com _______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop _______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
