msbill.info's DNS points to the same IP addresses as microsoft.com, and their servers give a specific 301 response for the header "Host: msbill.info", so msbill.info is almost definitely owned and operated by Microsoft. I don't think that confirms that the charges are coming from Microsoft, though.
Perhaps these are just Azure Front Door IP addresses? I don't have another site I can check, but it's possible that these IP addresses are used by lots of websites as part of the Azure infrastructure stack.
Spoofing a descriptor I get, the most confounding part to me is how the charges continued after rotating the amex account number - isn't the whole point of getting a new card that charges against the old account are refused? Did OP update their Microsoft account with the new number? Any other way for it to be leaked ?
Recurring charges often use some arrangement with the payment processor that doesn't actually use the literal card number after the first authorization. There's a bunch of contributing reasons but the obvious ones are security (no storing card numbers) and to make things easier for both companies and individuals when replacing cards, since most outright fraud is one-off charges.
I've had this happen to me before. I needed to cancel my credit card number and get a new one due to a fraud charge. I noticed that a bunch of valid subscriptions kept working despite me not updating the credit card number with them.
Recurring charges often use some arrangement with the payment processor that doesn't actually use the literal card number after the first authorization. There's a bunch of contributing reasons but the obvious ones are security (no storing card numbers) and to make things easier for both companies and individuals when replacing cards, since most outright fraud is one-off charges.
I've had this happen to me before. I needed to cancel my credit card number and get a new one due to a fraud charge. I noticed that a bunch of valid subscriptions kept working despite me not updating the credit card number with them.
I've had a similar issue with Amazon. Amazon was charging me for someone else's Prime subscription, apparently they had somehow linked my Discover card to their Amazon account. Amazon was unable to unlink my card, and suggested I get a new Discover card number, which I did (twice) and both times continued to be charged by their system on a monthly basis. I just dispute it every month now.
msbill.info's DNS points to the same IP addresses as microsoft.com, and their servers give a specific 301 response for the header "Host: msbill.info", so msbill.info is almost definitely owned and operated by Microsoft. I don't think that confirms that the charges are coming from Microsoft, though.
Perhaps these are just Azure Front Door IP addresses? I don't have another site I can check, but it's possible that these IP addresses are used by lots of websites as part of the Azure infrastructure stack.
I actually did a quick check and most of them didn't show up as Azure, just general MS IPv4 blocks. I would hope MS keeps its own infrastructure separate from the public Azure cloud...