71–80 of 206 posts
Earlier quoted context omitted.
How does MS know they aren't hosting it on purpose? That might cause them to just change the malicious URL.
Actual bad guys, hosting $Evil on purpose, are extremely unlikely to need any "change the URL" hints.
Earlier quoted context omitted.
How does MS know they aren't hosting it on purpose? That might cause them to just change the malicious URL.
I considered that but it didn't seem logical. If it's on purpose, it would be trivial to change the URL and then go "ok it's clean now please remove the flag" How does keeping secret (from the bad guys) where the malware is thwart the bad guys?
Or the bad guys themselves do that pretending to be the site owner. MS analysts can only inspect the normal site and the malicious URL that has now been removed in order to unblock it.
This is how abuse and IR works, I am surprised at the naivette of the responses here.
Earlier quoted context omitted.
How does MS know they aren't hosting it on purpose? That might cause them to just change the malicious URL.
I live in the USA. Victim blaming "they did something to deserve it" is at best unethical. In court theoretically I would have the right to demand to see evidence. "Hold my beer" is not likely to be sufficient except in egregious circumstances. With that said, there is an epidemic of muppet thinking right now. It's not just the intertubes. Suppose a credit card company pulls your credit report because they say you ap…
Earlier quoted context omitted.
See: spam blacklists
My own experience was with Wells Fargo, where I conduct quite a bit of business, but they still treated me like a criminal because their dumb AI thought that "I don't often initiate wire transfers online" and "my voice didn't sound like my age".
As has already been said, there's a chance that you are compromised and don't know. Obviously keep trying to contact MS, but in the mean time I'd make as much sure as you can that they don't have a legitimate beef. If you're willing to share more details about your site such as your tech stack, we can probably give you more specific advice beyond "check your logs for weirdness and hire a consultancy firm that deals w…
If MS have found a compromise they should share it. Making the allegation but not disclosing any reason is just slander.
In this case I also expect it's all very carefully worded ("Be careful! This site might be trying to harm your computer") to be legal even in cases when they accidentally (and inevitably) miscategorize a site.
I encountered this, I had a cloud service that I had spun up services on with some DNS records pointing to, and then abandoned. The IP address was then used by malware, but because my DNS pointed to it, my whole domain got blacklisted.
As has already been said, there's a chance that you are compromised and don't know. Obviously keep trying to contact MS, but in the mean time I'd make as much sure as you can that they don't have a legitimate beef. If you're willing to share more details about your site such as your tech stack, we can probably give you more specific advice beyond "check your logs for weirdness and hire a consultancy firm that deals w…
If MS have found a compromise they should share it. Making the allegation but not disclosing any reason is just slander.
People talking about is it a false flag, real flag... Post your SaaS URL and you'll get a free security assessment from a dozen hners.
I would however, probably be willing to DM people individually after doing a small amount of due diligence on their comment history. I guess it depends on sensitivity of the site and how desperate they are.
Earlier quoted context omitted.
Imagine that MS replies "we detected malware spreading from your site" without any other details. What is OP supposed to do then? Won't they be just as frustrated, if not more, than before?
Just "we detected malware spreading from your site" would sure narrow things down a lot. Time to inspect the web server access logs, 'diff' the site contents with a month-old backup, etc.