But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.
Recently the regulatory bodies did just that and so the banks should only use 1600 numbers to contact their customers. My bank scam calls have dropped to 0.
Same in their app eg you try to do a sepa wire to a new recipient and you get a warning "are you on the phone with someone ? did someone ask you to do that ? please call your bank by pressing this button. By the way we will never call you to ask an auth code or to do a wire"
"Hello, I'm calling from Blockchain, I would like to talk about your investment portfolio"
it weirded me out they would pretend to be from the underlying technology instead of an exchange or something. I kept thinking I should pretend to be the CEO of TCP/IP or something when they called.
always though the agreement was: we don't call you, you call us. we'll send letters though.
They have to make posts to assure people it's not a scam, especially as they'll ask you to mail ID etc to that address:
Would you please explain more?
There should be a long list of companies whose policies are worse than theirs.
It’s not a good excuse…
You mean like how they moved from a perfectly legible and rememberable domain like office.com to the strange vanity domain m365.cloud.microsoft?
Yeah. I queried the 1st thing that came to mind and internalmicrosoft.com and microsoftinternal.com are available. With that much potential out there, I'd want to keep my official domain group tight.
...and microsoftonline.com is not among them (unlike microsoftonline.net and other variants). But it seems to have been registered in 2002, and the record looks legit:
https://github.com/HotCakeX/MicrosoftDomains/blob/main/Micro...
but that one doesn't contain any microsoftonline.
That's because people report them as spam, so they hop domains to avoid that.
The real reason for multiple domains is likely more stupid than that. It’s likely because different teams want to move faster than the whole of Microsoft, so register a domain for their MVP to enable them to prototype like a start up. Because going through the usual hoops with enterprise regarding using their established domains will be a long and torturous process. And before long, their new prototype domain becomes so integrated into their product that adopting it as official is just easier than switching to microsoft.com.
I couldn’t say for sure that’s what has happened here. But it’s the story I’ve seen with domain ownership in other enterprises
This is why with rare, rare exceptions nothing "real" is on Microsoft.com including even the login page, with one exception (the passkey domain).
The new cloud.microsoft domain for Office will possibly help, but it's still a heck of a long list - https://learn.microsoft.com/en-us/microsoft-365/enterprise/u...
And IIRC this is just for office and windows, not azure.
It’d be interesting to hear a senior old-timer from MS to weigh in on their blog about this, and similar/adjacent problems that arise from working across such a colossal entity.
It’s a wonder they ever release anything new, if I’m being completely honest. The amount of governance, hoops, process and procedure across every aspect of their business must be staggering.
If the existence of a domain/subdomain is considered sensitive information, then something has gone very wrong.
Same with third party services, sometimes they used one for something for a while and collected customer or user data there and then stopped but kept paying for it, and forgot they had it. We typically found these through analysis of their accounting.
Easier to just keep paying.
Spam filters.
“Always has been.”
https://www.techmonitor.ai/technology/microsoft_forget_to_re...
For the past week, my Microsoft authenticator has been pinging about sign-ins from random places. Except the login history page is completely empty. Not even my own sign ins show up.
Now, you would be forgiven for thinking it's because my password leaked, but no. The default sign in flow with the app enabled is email + authenticator. No password required. In their eternal wisdom this option is not changeable in the app.
Microsoft really should realize that the only reason the account still exists is because they bought Minecraft and stop complicating my life.
Even after changing my password, I couldn't login to my email on my phone, so I just gave up. I only use that email for a handful of things anyway.
Isn't this only if browser have some cookie from previous session or IP didn't change?
Edit: just tried (new IP + private window firefox), you are right, I can enter email and select app notification.
It freaked me out the first time, I went through all the security settings I could find, but it was if it never happened.
I just ignored it the second time, but it's a bit unsettling, because the default authenticator flow also has the chance of accidentally hitting the right number.
I'm not sure this is the same type of issue but found this interesting, especially since apparently it's been reported to MS and no action has been taken.
Reminds me, we once got a letter by a German government body requesting some data exports from our company, and to upload them on findrive-ni.de
It turned out to be legit, but it's neither a subdomain of the state of Niedersachsen domain nor referenced in their official sites.
Who to contact? How to make Google stop? Where to report the abuse of their services? I can't find out. The whole service is basically a big <bleep> off and "we don't want any contact."
Maybe I also need to publish some article, so it can be published here on HN? Maybe that could give it some traction for someone at Google to look into it?
I submitted an account that sent phishing emails last week, but I’m told it’s basically a black hole and to not expect anything anything to happen.
When doing a WHOIS on that IP we'll get a contact address for abuse reports: "google-cloud-compliance@google.com", but sending anything there, returns an error that the user doesn't exists.
The Microsoft emails are coming from microsoft-noreply@microsoft.com so it's a bit different than in this article.
Trying to report this was an exercise in futility, I guess they get so much beg bounty spam that their security submission process filters out the occasional legitimate issue.
Emails comming legitimeley from noreply@business.facebook.com with the text below. Go and decypher which part is Meta template and which is creative use of user supplied text...
Your Meta's Page may be at risk due to unusual
activity is not part of or affiliated with
Meta. Only approve requests and invitations from
people and businesses that you know and trust.
Meta will never ask for passwords, payment
information or personal details in an email. You've
received a partner request. Partners are other
businesses that you work with on Facebook. Partner
sharing lets you give access to your business assets,
but not to your business portfolio. This request is
from:
Your Page is under restriction review Contact Meta
Support: metafanpageviolate@gmail.com Protect yourself
from fraud: Verify the identity of the requester by
contacting the business using official contact information.This is a failure on PayPal’s email template that the freeform text field appears just as legit as other items. The text label was something like “Message from Sender”.
This is a somewhat common pattern in scams - abusing freeform text fields in emails or other messages to give the impression that a message is coming from a source that didn't intend to send it.
Another variant I've seen is malicious URLs linking to search engines which display the user's search terms, e.g. a link to a Microsoft site search with a prefilled search of "YOU HAVE A VIRUS, CALL MICROSOFT SUPPORT 555-1212".
That's not a misconfiguration, that's incompetence.
How do these people get hired?
1. be government agency
2. pay 30-70% less than private sector companies would for a similar position
3. receive applicants that are 30-70% less competent
Bonus:
- have 30+ year old systems nobody understands anymore because the team behind them has been dead/retired for a decade
- have hiring process handled entirely by out of touch suits
- have a revolving door of motivated soon-to-be burnouts mopping up the mess behind the aforementioned regular employees
(IPv6 is currently safe... for now...)
Do other email providers penalize that specific domain only, or all microsoft domains to a tiny degree?
Typically it's a mis-placed feature. Something like "send an email alert when a thing happens" and they let you control what goes in the message body as well as who the message should be sent towards. Sounds reasonable on the surface, but without guardrails it lets folks send arbitrary emails from your domain.
Imagine this is some truly errant copilot instance truly embracing its slop destiny.
lol