Endpoint Protection

We recently noticed intermittent HTTPS traffic over port 443 from Internet Explorer 11 to the URL r20swj13mr.microsoft.com.  We've since run full AV scans that did not detect any risks.   

Does anyone know if this is a legitimate site?   It uses the Microsoft domain but looks odd.  We've researched the site but are unable to find anything definitive.  Is the site associated with any viruses or malware?

We'll apologise in advance if we've posted to the wrong forum.

Thanks,

Wally

It's a microsoft domain. Everything I've checked shows it to be legit

Thanks Brian. We noticed that it appeared the first time that Internet Explorer was executed after putting on the October, 2016 Security Only maintenance.  It may have always been there - it's just one of those things that popped out when we were testing.  We haven't seen it since.  Could be some Windows telemetry dialing home.  

We've researched also.  Seems legit to us too, but no one seems to know what it is or "why"? 

We'll give you the solution with the caveat "buyer beware".   We're not attesting that it is or is not legitimate given the lack of information available to us at this time. 

Update - looks like the traffic is related to either CEIP or Internet Explorer automatically checking for updates.   Both can be managed by GPO.

Windows - Computer Configuration > Administrative Templates > System > Internet Communications Management > Internet Communication Settings

Internet Explorer - Computer Configuration > Administrative Templates > Windows Components > Internet Explorer

Still don't know what r20swj13mr.microsoft.com is used for, but it appears that it can be managed/turned off.

Disregard the comments about turning it off with GPO.   We're still seeing it from time to time.

The traffic to r20swj13mr.microsoft.com appears to only occur the first time that Internet Explorer 11 is opened after the monthly IE Microsoft patch(es) is/are applied.  That seems to be the only time we see it and then not every time.

We see traffic over TCP port 443 to r20swj13mr.microsoft.com twice upon opening IE.  One session for the 32-bit instance and one session for the 64-bit instance.

It may have always done this - maybe we are just noticing it. 

It would be interesting to know what  r20swj13mr.microsoft.com is used for.

I guess that we can always block it at the firewall or hosts file.