Hacker News

Tangent: I used to receive at least a dozen bank scam calls per day in India, especially during insurance renewal. I wanted the banks to publish official phone numbers and mandate their employees to use only official numbers.

Recently the regulatory bodies did just that and so the banks should only use 1600 numbers to contact their customers. My bank scam calls have dropped to 0.

Not only that, but they wrap the links in their email with click tracking provided by domains that have nothing to do with them (Mailgun or whatever). So even if you try to introspect the links you're clicking, they seem to go to a scammy domain even if they're legit!

Bluesky is even worse, some of their emails come from "[email protected]".

They have to make posts to assure people it's not a scam, especially as they'll ask you to mail ID etc to that address:

https://bsky.app/profile/safety.bsky.app/post/3ljp6zi7tp227

Remember those indian microsoft support centers and that strange correlation of you being called by a indian microsoft scammer the next day after you called there. Not implying causation.. just..

> Who even can be sure microsoftonline.com is legit.

Yeah. I queried the 1st thing that came to mind and internalmicrosoft.com and microsoftinternal.com are available. With that much potential out there, I'd want to keep my official domain group tight.

Seems like it would make sense to only use subdomains of microsoft.com?

> unable publish a list with all domains they officially use to send mail

That's because people report them as spam, so they hop domains to avoid that.

https://github.com/HotCakeX/MicrosoftDomains

...and microsoftonline.com is not among them (unlike microsoftonline.net and other variants). But it seems to have been registered in 2002, and the record looks legit:

https://whois.domaintools.com/microsoftonline.com

I got used to that one, but the other day I was checking Outlook in the web browser and I ended up on outlook.cloud.microsoft, I couldn't believe my eyes.

“So Microsoft’s domain story is a total mess?”

“Always has been.”

https://www.techmonitor.ai/technology/microsoft_forget_to_re...

Such a list will never exist in an organisation of this size, with the amount of delegated management and operations required for these functions. In fact, it’s unlikely such a list is even _allowed_ to exist given the sensitive nature of some areas of the business, being a publicly traded company which works directly with regulated entities and governments.

It’d be interesting to hear a senior old-timer from MS to weigh in on their blog about this, and similar/adjacent problems that arise from working across such a colossal entity.

It’s a wonder they ever release anything new, if I’m being completely honest. The amount of governance, hoops, process and procedure across every aspect of their business must be staggering.

This was a common issue when I consulted with bankruptcy lawyers and had to figure out what domain assets the company had. Commonly the representatives only knew about some of the domains and we found at least a few more.

Same with third party services, sometimes they used one for something for a while and collected customer or user data there and then stopped but kept paying for it, and forgot they had it. We typically found these through analysis of their accounting.

> Who even can be sure microsoftonline.com is legit

Spam filters.

A keming attack in the wild...

Microsoft also has this cool thing where if someone fails to get into your account too many times, your account can get locked and you are asked to reset your password. For a working password.

Even after changing my password, I couldn't login to my email on my phone, so I just gave up. I only use that email for a handful of things anyway.

> The default sign in flow with the app enabled is email + authenticator. No password required

Isn't this only if browser have some cookie from previous session or IP didn't change?

Edit: just tried (new IP + private window firefox), you are right, I can enter email and select app notification.

I also had this starting a few months back. I changed the email address (really, just an alias to the same mailbox as before) and the notifications stopped.

I've been getting this too, authenticator prompts saying "logged in" and asking for confirmation, but no history whatsoever when I went to security to check.

It freaked me out the first time, I went through all the security settings I could find, but it was if it never happened.

I just ignored it the second time, but it's a bit unsettling, because the default authenticator flow also has the chance of accidentally hitting the right number.

It is the same company that want to stop SMS 2fa to force you to use their shitty authenticator app.

Hell, they have .microsoft. Why'd they bother?

You are correct.

Reminds me, we once got a letter by a German government body requesting some data exports from our company, and to upload them on findrive-ni.de

It turned out to be legit, but it's neither a subdomain of the state of Niedersachsen domain nor referenced in their official sites.

I have not seen one of these that wasn't a compromised hotel email or booking account. I have had to "help" a hotel get malware/RATs off their system more than a dozen times as a _guest_

Yeah, I fell into that rabbit hole once. Tried all abuse contacts that I could find. network-abuse@ refers you to the Google Cloud abuse form. They ‘are not able to take action on this report since the IP mentioned in the report is not hosted on Google Cloud.’ Gmail abuse doesn’t even bother to reply (why should they, it’s not about Gmail after all). In the end, I just blocked DKIM identifiers related to Firebase via Rspamd.

You can try: https://support.google.com/mail/contact/abuse?hl=en

I submitted an account that sent phishing emails last week, but I’m told it’s basically a black hole and to not expect anything anything to happen.

I've been receiving these for so long I started thinking it must be just me being targeted and not widespread, as Meta seems to not do anything about it.

Emails comming legitimeley from [email protected] with the text below. Go and decypher which part is Meta template and which is creative use of user supplied text...

  Your Meta's Page may be at risk due to unusual
  activity is not part of or affiliated with
  Meta. Only approve requests and invitations from
  people and businesses that you know and trust.
  Meta will never ask for passwords, payment
  information or personal details in an email. You've
  received a partner request. Partners are other
  businesses that you work with on Facebook. Partner
  sharing lets you give access to your business assets,
  but not to your business portfolio. This request is
  from:

  Your Page is under restriction review Contact Meta
  Support: [email protected] Protect yourself
  from fraud: Verify the identity of the requester by
  contacting the business using official contact information.

The ones I've seen from PayPal are basically from sending a large request for money to you, then in the freeform text field for the reason, putting fake "if you believe this is a scam, call [actually a scam number]" text.

PayPal itself is a scam.

>The FBI is aware of a software misconfiguration

That's not a misconfiguration, that's incompetence.

How do these people get hired?

The domain is Microsoftonline.com

Typically it's a mis-placed feature. Something like "send an email alert when a thing happens" and they let you control what goes in the message body as well as who the message should be sent towards. Sounds reasonable on the surface, but without guardrails it lets folks send arbitrary emails from your domain.