We have, just not here. 😊

It's being ... investigated.

Sorry for the delay.

Michael J Wise
Microsoft Corporation| Spam Analysis
"Your Spam Specimen Has Been Processed."
Got the Junk Mail Reporting 
Tool<http://www.microsoft.com/en-us/download/details.aspx?id=18275> ?

-----Original Message-----
From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Scott Undercofler
Sent: Friday, February 9, 2018 2:15 PM
To: mailop <mailop@mailop.org>
Subject: Re: [mailop] Extreme amounts of SMTP auth from microsoft/outlook IPs

Its hitting a set of accounts over and over and over at least on my “older” 
system. On the newer system, Im blocking them for too many connections today so 
its hard to tell.

Strangely enough the MS contacts on this list haven’t chimed in….

> On Feb 9, 2018, at 2:56 PM, Dave Warren via mailop 
> <mailop@mailop.org<mailto:mailop@mailop.org>> wrote:


> On 2018-02-09 14:20, John Levine wrote:

>> In article 
>> <CABa8R6txLmPrVSbVXzQBM+UB=fx6tdlv_ebpalps1q1ktvh...@mail.gmail.com<mailto:CABa8R6txLmPrVSbVXzQBM+UB=fx6tdlv_ebpalps1q1ktvh...@mail.gmail.com>>
>>  you write:

>>> I'm confused, the first post said valid credentials, is that what

>>> everyone else is seeing?


>>> Nearly all valid creds seems weirder than mostly invalid... modulo

>>> whatever amount of hijacked or reused creds there are.

>> Remember that Outlook does account consolidation like Gmail does, and

>> outgoing mail for a consolidated address usually goes through the

>> account's own server to make it more DMARC-y.

>> It's not surprising that Outlook would be doing valid SMTP AUTH, but

>> you would expect it to send a message after it does so.


> I could imagine them doing a periodic recheck to validate passwords or find 
> problems too, but I would only expect a single connection per account.


> For those seeing this, is it hitting the same account more than once, or just 
> once per account?




> _______________________________________________

> mailop mailing list

> mailop@mailop.org<mailto:mailop@mailop.org>

> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchill

> i.nosignal.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fmailop&data=04%7C01%7C

> michael.wise%40microsoft.com%7C114e15a7a27840fbf1a308d5700b3f5c%7Cee33

> 03d7fb734b0c8589bcd847f1c277%7C1%7C1%7C636538115970901154%7CUnknown%7C

> TWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwifQ%3D%

> 3D%7C-1&sdata=6%2BAE03aZoujOgC9CmNxKsXC7wjhXXqJzZ%2B2dxpao%2BrQ%3D&res

> erved=0


mailop mailing list


mailop mailing list

Reply via email to