Hi,
Our organization detected thousands of GET requests were observed originating from an external IP address owned by Oracle Cloud (141.147.139.63) in a short time targeting the Microsoft Exchange ActiveSync endpoint (/Microsoft-Server-ActiveSync/default.eas). Each request attempted to authenticate using all of our Active Directory users accounts resulting in repeated HTTP 401 Unauthorized responses and accounts got locked.
Why are we seeing this behaviour from a legitimate IPs,is this expected?
Regards,
Moh