Scammers are abusing an internal Microsoft account to send spam links

Post by e40 » Sun, May 24, 2026, 12:59 PM UTC

T-A wrote: post #36

weinzierl wrote: post #9

Who even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complete list of all the domain assets they own. But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.

https://github.com/HotCakeX/MicrosoftDomains ...and microsoftonline.com is not among them (unlike microsoftonline.net and other variants). But it seems to have been registered in 2002, and the record looks legit: https://whois.domaintools.com/microsoftonline.com

Post by e40 » Sun, May 24, 2026, 1:05 PM UTC

Numerlor wrote: post #67

greatgib wrote: post #65

Earlier quoted context omitted.

It is the same company that want to stop SMS 2fa to force you to use their shitty authenticator app.

SMS 2FA is the worst factor because of how insecure and phishable the phone network is, it deserves to die out where possible

Post by eterm » Sun, May 24, 2026, 1:30 PM UTC

e40 wrote: post #92

eterm wrote: post #60

Earlier quoted context omitted.

I've been getting this too, authenticator prompts saying "logged in" and asking for confirmation, but no history whatsoever when I went to security to check. It freaked me out the first time, I went through all the security settings I could find, but it was if it never happened. I just ignored it the second time, but it's a bit unsettling, because the default authenticator flow also has the chance of accidentally hit…

Is that because it’s two digits?

Post by kro » Sun, May 24, 2026, 1:48 PM UTC

drdec wrote: post #94

I feel sad that what I think of as the obvious solution, companies using subdomains like internal.microsoft.com instead of making a million different domains, is so far from happening that no one here on HN has even brought it up.

Post by Scoundreller » Sun, May 24, 2026, 1:53 PM UTC

seanhunter wrote: post #77

TeMPOraL wrote: post #61

Earlier quoted context omitted.

> They are not scam calls What are they, then? Sales/marketing calls? Or some security notifications ("we noticed some suspicious operations in the last 3 days...")? If it's the former, that's still scam in my books. Specifically, it's a first-party scam , as opposed to a third-party scam , where some third party pretends to be your bank. They both should be treated similarly; unfortunately, you can't report first-pa…

Yeah as sibling points out, lots of orgs have scammy official security calls. This leads to a dance I have been through quite often. Hello Them: Am I speaking to Sean Hunter Me: Yes Them: This is . Can you confirm your Me: Yes Them: Err, … sorry I didn’t quite catch that. Me: Yes. Them: I asked whether you can confirm your Me: Yes. I can. Them: err… I can’t talk to you without you passing security. Me: You called me.…