Source
r/sysadmin•
forkwhilef0rk

Microsoft published an unregistered domain in an official document

I was researching the differences between Windows 10 Pro and Enterprise, which lead me to this page. If you scroll most of the way down, there's a link that says "DOWNLOAD FULL COMPARISON TABLE" which leads here. On page 9 of that document, under the heading for "Application compatibility", there's a row that just says "Ready4Microsoft365.com". That domain was unregistered.....until about an hour ago.

​

I already let my friend at microsoft know, so it'll probably get fixed before too long. But, seriously? Why would you publish a document with an unregistered domain in it? That's just asking for malware.

Posted Jan 27, 2020, 7:28 PM UTC

3325
ZAFJB•

I love its homepage :)

'probably not tbh'

41
Panacea4316Head Sysadmin In Charge•

It gave me a good chuckle.

5
PaulCunninghamSurvivingITBook.com <- Free to read online•

Some years ago they also baked into Exchange Server 2013 a domain that they didn't own - inboundproxy.com

It was used to send Managed Availability health probes.

Someone else registered the domain and parked it. For a while, health probe emails that bounced would send an NDR out of your org to whatever SMTP server the domain owner had running. Eventually I guess they got sick of that, and stopped accepting mail to that domain. So now customers had outbound NDRs queuing to a valid domain with no MX or no SMTP server (can't remember which) and filling up mail queues on their mail servers.

Since they couldn't register inboundproxy.com themselves, Microsoft patched Exchange to use contoso.com for the probe messages instead.

14
forkwhilef0rkOPNetadmin•

wow, that's much worse!

2
wendal•

The site is already blocked as malware by OpenDNS. :(

6
forkwhilef0rkOPNetadmin•

probably just classified as unknown

6
wendal•

Oh yes, you are correct. I forgot it says "malware" when it is classified in the newly seen domains category.

1
redwire2012Sysadmin•

It does that from the first hit it gets on a domain for 14 days I think, nice feature for blocking constantly rotating CNC servers, you can whitelist to get around it.

2
Dorest0rmDoing the needful•

Classified phising now.

1
forkwhilef0rkOPNetadmin•

Rip

1
jmbpiano•

I see you've got a tracking script on there so now I'm curious. Getting many hits that weren't from here?

3
forkwhilef0rkOPNetadmin•

I made a google analytics project just for this, so I'm not very experienced with the platform. It's looking like 75% direct and 25% from reddit? But I saw facebook on there for a split-second so I think it's just struggling to draw meaningful insights from such a small amount of data.

4
Literal_Sperg•

Well, ready4office365.com doesn't get anything either. wonder if maybe ready4microsoft365.com was something that was considered, but never done.

2
Henry_Horsecock•

Lol'd

2
forkwhilef0rkOPNetadmin•

Well, they're sort of right

1
[deleted]•

[removed]

1
twisted636•

Hmmm I wonder if this is something microsoft would buy back from the person that got it first?

1
forkwhilef0rkOPNetadmin•

if I'm lucky lol

5
FriedEggg•

Tweet at @SwiftOnSecurity if you can't get their attention. This is the sort of thing they enjoy, and MS will pay attention.

3
forkwhilef0rkOPNetadmin•

Didn't think about that. Like I said I mentioned it to my friend who works there so I think it's being looked at but I guess we'll see.

1
twisted636•

hahahah, let us know how it goes

1
forkwhilef0rkOPNetadmin•

will do

1
Asthemic•

"Buy him out boys."

:)

1
liteseci don't even know anymore•

could try to disclose on hackerone as a domain takeover

probably falls out of scope but it's at least a way to get it addressed quickly by people who monitor for these reports

1
Jwn5k•

BETHESDA?

-1