5 ms·
Who even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complet
by weinzierl 5mo ago
Who even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complete list of all the domain assets they own.
But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.
- inetknght 5mo ago> unable publish a list with all domains they officially use to send mail That's because people report them as spam, so they hop domains to avoid that.
- saghm 5mo agoOkay, so then they should stop doing stuff like trying to push people to log into Windows with Microsoft accounts instead of offline credentials and then using that as an excuse to send out inane marketing emails that no one wants. "We're doing something shitty as a workaround for the consequences of other shitty things we do" isn't a particularly good reason for not acting so shitty.
- hnlmorg 5mo agoFor a company with as much weight in the industry as Microsoft, it would be trivial to ensure their domains don’t end up on spam lists. Heck, because of outlook.com, they control have the spam lists themselves. The real reason for multiple domains is likely more stupid than that. It’s likely because different teams want to move faster than the whole of Microsoft, so register a domain for their MVP to enable them to prototype like a start up. Because going through the usual hoops with enterprise regarding using their established domains will be a long and torturous process. And before long, their new prototype domain becomes so integrated into their product that adopting it as official is just easier than switching to microsoft.com. I couldn’t say for sure that’s what has happened here. But it’s the story I’ve seen with domain ownership in other enterprises
- hirsin 5mo agoMicrosoft.com is also owned by the marketing org, not the engineering org, for various reasons that predate the existence of many employees at Microsoft now. This is why with rare, rare exceptions nothing "real" is on Microsoft.com including even the login page, with one exception (the passkey domain). The new cloud.microsoft domain for Office will possibly help, but it's still a heck of a long list - https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/enterprise/u... And IIRC this is just for office and windows, not azure.
- apimade 5mo agoSuch a list will never exist in an organisation of this size, with the amount of delegated management and operations required for these functions. In fact, it’s unlikely such a list is even _allowed_ to exist given the sensitive nature of some areas of the business, being a publicly traded company which works directly with regulated entities and governments. It’d be interesting to hear a senior old-timer from MS to weigh in on their blog about this, and similar/adjacent problems that arise from working across such a colossal entity. It’s a wonder they ever release anything new, if I’m being completely honest. The amount of governance, hoops, process and procedure across every aspect of their business must be staggering.
- 10000truths 5mo ago> In fact, it’s unlikely such a list is even _allowed_ to exist given the sensitive nature of some areas of the business, being a publicly traded company which works directly with regulated entities and governments. If the existence of a domain/subdomain is considered sensitive information, then something has gone very wrong.
- antiframe 5mo agoCompanies do register domains before launching products and don't want to leak them. Now, I still support Microsoft and other companies to list the domains they send official emails from.
- seb1204 5mo agoWhy would that not be possible? You can still do that and then once the rabbit is out add it to the main list. Come on, don't let the good be the enemy of the perfect. I'm sure there are several ways to find and list all domains. What bothers me more is that they allowed to have different domains in the first place. Why not sub domains to make it clear.
- antiframe 5mo agoThat's what I said? Companies can hide domains while they are under development but then they should still maintain a list that they send emails from. I was opposed to legislation that required all registered domains regardless of use being published.
- qingcharles 5mo agoBluesky is even worse, some of their emails come from "moderation@blueskyweb.xyz". They have to make posts to assure people it's not a scam, especially as they'll ask you to mail ID etc to that address: https://bsky.app/profile/safety.bsky.app/post/3ljp6zi7tp227 https://bsky.app/profile/safety.bsky.app/post/3ljp6zi7tp227
- jquery 5mo agoAt least Bluesky has an excuse of not being a Fortune 50 company. What’s Microsoft’s excuse?
- lostlogin 5mo ago‘We built it 30 years ago, it’s sort of compatible with everything and we will never deprecate.’ It’s not a good excuse…
- vasco 5mo agoSending your id to a social media IS a scam.
- fragmede 5mo agoWhat definition of the word scam are you using here? What promise of a product that you pay for that isn't being delivered, with uploading your id to a site on the Internet?
- Abishek_Muthian 5mo agoTangent: I used to receive at least a dozen bank scam calls per day in India, especially during insurance renewal. I wanted the banks to publish official phone numbers and mandate their employees to use only official numbers. Recently the regulatory bodies did just that and so the banks should only use 1600 numbers to contact their customers. My bank scam calls have dropped to 0.
- hunter2_ 5mo agoKnowing what numbers are real through an official publication is very good, but it only allows you to place trust in calls you make, not calls you receive, because making calls doesn't involve caller ID, receiving calls does, and caller ID is spoofable.
- bdavbdav 5mo agoThat would take nothing to implement. Services like Truecaller already do live caller ID against databases on iOS / Android. All it would take is a sensible register of verified numbers
- Abishek_Muthian 5mo agoSeveral of the bank scammers had their profile verified as the bank in the Truecaller[1]. [1] https://xcancel.com/Abishek_Muthian/status/1806348022290211321 https://xcancel.com/Abishek_Muthian/status/18063480222902113...
- l23k4 5mo agoTruecaller can tell you about who a phone number belongs to. Truecaller cannot accurately tell you whether or not the person calling you from a phone number is actually in control of that phone number.
- TeMPOraL 5mo agoWon't stop people from trying to make Truecaller, et al. prove that, though. The problem here is that the correct security posture of the bank against third-party scams also protects the customers from first-party scams. Telling people the bank will never call them for anything, and even if, they're to always hang up and call the number on the back of their card, works equally well against criminals and telemarketers.
- WarOnPrivacy 5mo ago> Who even can be sure microsoftonline.com is legit. Yeah. I queried the 1st thing that came to mind and internalmicrosoft.com and microsoftinternal.com are available. With that much potential out there, I'd want to keep my official domain group tight.
- SoKamil 5mo ago> Who even can be sure microsoftonline.com is legit Spam filters.
- saghm 5mo agoI'm either impressed by whatever spam filter you having literally zero false positives or negatives, or I'm confused about what you think it means to "be sure".
- consp 5mo agoI have plenty of false negatives, mostly due to companies in know I get a mail from using spamlike html mails, I always verify on the phone it is the mail they send to be sure but it happens way too often.
- cess11 5mo agoThis was a common issue when I consulted with bankruptcy lawyers and had to figure out what domain assets the company had. Commonly the representatives only knew about some of the domains and we found at least a few more. Same with third party services, sometimes they used one for something for a while and collected customer or user data there and then stopped but kept paying for it, and forgot they had it. We typically found these through analysis of their accounting.
- lostlogin 5mo agoHaving a service crap out because someone didn’t pay for the domain is almost a trope. It never occurred to me that the reverse might happen - paying for unused domains.
- doubled112 5mo agoWe pay for a bunch of old domains because nobody in the org can definitively say we never used it and/or don’t use it anymore. Easier to just keep paying.
- T-A 5mo agohttps://github.com/HotCakeX/MicrosoftDomains https://github.com/HotCakeX/MicrosoftDomains ...and microsoftonline.com is not among them (unlike microsoftonline.net and other variants). But it seems to have been registered in 2002, and the record looks legit: https://whois.domaintools.com/microsoftonline.com https://whois.domaintools.com/microsoftonline.com
- cuteboy19 5mo agobut microsoftgenuinerewardsrc.com is! shameful!
- balakk 5mo agoIt's definitely a Microsoft owned domain and actively used - for example in Azure Active Directory (Entra).
- KomoD 5mo agomicrosoftonline.com is in that list.
- T-A 5mo agoYou're right. I wonder how I managed to miss it. For a moment I thought I must have looked at https://github.com/HotCakeX/MicrosoftDomains/blob/main/Microsoft%20Domains%20-%20EASM.txt https://github.com/HotCakeX/MicrosoftDomains/blob/main/Micro... but that one doesn't contain any microsoftonline.
- e40 5mo agoI did not expect 645 entries!! That is insane.
- HDBaseT 5mo ago1drv.ms always catches me out.
- ntoskrnl_exe 5mo agoI got used to that one, but the other day I was checking Outlook in the web browser and I ended up on outlook.cloud.microsoft, I couldn't believe my eyes.
- warumdarum 5mo agoRemember those indian microsoft support centers and that strange correlation of you being called by a indian microsoft scammer the next day after you called there. Not implying causation.. just..
- EGreg 5mo ago“So Microsoft’s domain story is a total mess?” “Always has been.” https://www.techmonitor.ai/technology/microsoft_forget_to_renew_hotmail_domain_again/ https://www.techmonitor.ai/technology/microsoft_forget_to_re...
- gwbas1c 5mo agoSeems like it would make sense to only use subdomains of microsoft.com?
- aftbit 5mo agoNot only that, but they wrap the links in their email with click tracking provided by domains that have nothing to do with them (Mailgun or whatever). So even if you try to introspect the links you're clicking, they seem to go to a scammy domain even if they're legit!
- 486sx33 5mo ago[dead]
- crimsonnoodle58 5mo ago> Microsoft's domain story is such a mess You mean like how they moved from a perfectly legible and rememberable domain like office.com to the strange vanity domain m365.cloud.microsoft?
- butvacuum 5mo agothe domain that ever m365 tennant exists on? that microsoftonline.com?