Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammers are abusing an internal Microsoft account to send spam links

techcrunch.com

Post reply on HN
Print view View original

11–20 of 196 posts

Re: Scammers are abusing an internal Microsoft account to send spam links

#11

Post by inetknght »

weinzierl wrote: post #9

Who even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complete list of all the domain assets they own. But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.

> unable publish a list with all domains they officially use to send mail

That's because people report them as spam, so they hop domains to avoid that.

Re: Scammers are abusing an internal Microsoft account to send spam links

#12

Post by apimade »

weinzierl wrote: post #9

Who even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complete list of all the domain assets they own. But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.

Such a list will never exist in an organisation of this size, with the amount of delegated management and operations required for these functions. In fact, it’s unlikely such a list is even _allowed_ to exist given the sensitive nature of some areas of the business, being a publicly traded company which works directly with regulated entities and governments.

It’d be interesting to hear a senior old-timer from MS to weigh in on their blog about this, and similar/adjacent problems that arise from working across such a colossal entity.

It’s a wonder they ever release anything new, if I’m being completely honest. The amount of governance, hoops, process and procedure across every aspect of their business must be staggering.

Re: Scammers are abusing an internal Microsoft account to send spam links

#14

Post by 10000truths »

apimade wrote: post #12
weinzierl wrote: post #9

Who even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complete list of all the domain assets they own. But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.

Such a list will never exist in an organisation of this size, with the amount of delegated management and operations required for these functions. In fact, it’s unlikely such a list is even _allowed_ to exist given the sensitive nature of some areas of the business, being a publicly traded company which works directly with regulated entities and governments. It’d be interesting to hear a senior old-timer from MS to w…

> In fact, it’s unlikely such a list is even _allowed_ to exist given the sensitive nature of some areas of the business, being a publicly traded company which works directly with regulated entities and governments.

If the existence of a domain/subdomain is considered sensitive information, then something has gone very wrong.

Re: Scammers are abusing an internal Microsoft account to send spam links

#15

Post by qingcharles »

weinzierl wrote: post #9

Who even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complete list of all the domain assets they own. But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.

Bluesky is even worse, some of their emails come from "moderation@blueskyweb.xyz".

They have to make posts to assure people it's not a scam, especially as they'll ask you to mail ID etc to that address:

https://bsky.app/profile/safety.bsky.app/post/3ljp6zi7tp227

Re: Scammers are abusing an internal Microsoft account to send spam links

#16

Post by jquery »

qingcharles wrote: post #15
weinzierl wrote: post #9

Who even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complete list of all the domain assets they own. But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.

Bluesky is even worse, some of their emails come from "moderation@blueskyweb.xyz". They have to make posts to assure people it's not a scam, especially as they'll ask you to mail ID etc to that address: https://bsky.app/profile/safety.bsky.app/post/3ljp6zi7tp227

At least Bluesky has an excuse of not being a Fortune 50 company. What’s Microsoft’s excuse?

Re: Scammers are abusing an internal Microsoft account to send spam links

#17

Post by Abishek_Muthian »

weinzierl wrote: post #9

Who even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complete list of all the domain assets they own. But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.

Tangent: I used to receive at least a dozen bank scam calls per day in India, especially during insurance renewal. I wanted the banks to publish official phone numbers and mandate their employees to use only official numbers.

Recently the regulatory bodies did just that and so the banks should only use 1600 numbers to contact their customers. My bank scam calls have dropped to 0.

Re: Scammers are abusing an internal Microsoft account to send spam links

#18

Post by casty »

redwall_hp wrote: post #8
wnevets wrote: post #3

Is something similar happening with paypal? I've been getting seemly emails from the PayPal domain that are obviously a scam.

The ones I've seen from PayPal are basically from sending a large request for money to you, then in the freeform text field for the reason, putting fake "if you believe this is a scam, call [actually a scam number]" text.

I can confirm. Interestingly they actually put a random USDC transaction number from Coinbase which was very close (close enough that I thought it was accurate) of a transaction I actually did on Coinbase at one point. I was so confused so I ended up calling the number but immediately realized once they picked up what was going on. Essentially they got really lucky that my actual transaction amount was close enough to seem plausible.

This is a failure on PayPal’s email template that the freeform text field appears just as legit as other items. The text label was something like “Message from Sender”.

Re: Scammers are abusing an internal Microsoft account to send spam links

#19

Post by duskwuff »

casty wrote: post #18
redwall_hp wrote: post #8

Earlier quoted context omitted.

The ones I've seen from PayPal are basically from sending a large request for money to you, then in the freeform text field for the reason, putting fake "if you believe this is a scam, call [actually a scam number]" text.

I can confirm. Interestingly they actually put a random USDC transaction number from Coinbase which was very close (close enough that I thought it was accurate) of a transaction I actually did on Coinbase at one point. I was so confused so I ended up calling the number but immediately realized once they picked up what was going on. Essentially they got really lucky that my actual transaction amount was close enough t…

> This is a failure on PayPal’s email template that the freeform text field appears just as legit as other items.

This is a somewhat common pattern in scams - abusing freeform text fields in emails or other messages to give the impression that a message is coming from a source that didn't intend to send it.

Another variant I've seen is malicious URLs linking to search engines which display the user's search terms, e.g. a link to a Microsoft site search with a prefilled search of "YOU HAVE A VIRUS, CALL MICROSOFT SUPPORT 555-1212".

Re: Scammers are abusing an internal Microsoft account to send spam links

#20

Post by vasco »

qingcharles wrote: post #15
weinzierl wrote: post #9

Who even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complete list of all the domain assets they own. But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.

Bluesky is even worse, some of their emails come from "moderation@blueskyweb.xyz". They have to make posts to assure people it's not a scam, especially as they'll ask you to mail ID etc to that address: https://bsky.app/profile/safety.bsky.app/post/3ljp6zi7tp227

Sending your id to a social media IS a scam.
Post reply on HN