URLs blocked for phishing / URL Detonation Reputation despite beeing clean

Question

Hello,

starting April our customers notified us about a unwanted behavior with our URLs used for our product.

Every URL keeps getting thrown into Quarantine for phishing / high for every customer M365 tenant.

We checked every file out customers uploaded for malicious content and behavior but couldn't find anything, that would justify blocking every URL as phishing.

Unfortunately, the Windows Defender support still tries to fix the issue with only our tenant. The problem with this is, that this is a problem that NOT only happens to us. This is happening with every URL form our application for any customer with an Office 365 tenant, who wants to send or receive an email containing a URL from our application.

To clarify, we tested against every known blocklist/spamlist and every email provider we can, and couldn't reproduce this behavior. This is only happening to Microsoft 365 Tenants.

Every time we submit a URL and email to get checked as false positive it gets marked with "No threats found." Unfortunately this is not the way we can fix this issue because for the time being, this only helps with our tenant, but not the tenants of our customers. We would also need to submit about 20k of URLs to be checked because no wildcards can be submitted as "false positive". The URL Detonation tree is empty.

The Microsoft Security Intelligence portal doesn't help either, because the URLs blocked for phishing were commented with:
"Reported URL address have no current blocks and we have no reports of malicious activity either."

Submitted URL result (Microsoft Defender Portal):
No threats found. This item has been identified as clean. It might have blocked for a variety of reasons (for example, sender reputation). To prevent similar items from being blocked in the future, you can create allow entries (domain or address, URL, File) in the Tenant Allow/Block List. After a period of evaluation, the filters might be updated using the information from the submission.

Example URLs (these are not the real URLs because of privacy reasons):

• customer.domain.tld/share/<share_id>
• customer.domain.tld/share/<share_id>/media
• customer.domain.tld/auth/login
• customer.domain.tld

Most of them have the same domain. If

We still can't figure out why this is happening and need urgent help with at least have someone tell us the exact reason the system has classified our domains/urls as malicious.

We want to and need to resolve this issue as fast as possible. It would be very helpful for everyone if there was a tool you could use to get the EXACT reason why a URL/domain is blocked. If there is one, please send me a link, the documentation and support didn't send me anything to work with.

Thanks in advance.

Best regards,
Christian

Answer 1

Hello Christian,

* I am a Microsoft user like you, providing solutions to community members; I am NOT a Microsoft employee.

Sorry about the issue you're experiencing. Resolving this particular issue tends to be tedious for most customers; however, I will share some solutions that I found on a thread (https://answers.microsoft.com/thread/332b93aa-dfca-4a15-b2de-7fd55890fc75):

1. By Bobanner: "I had a customer with a similar issue. He was sending out invoices via QuickBooks. Often his messages would be quarantined with the notice, High Confidence Phish. Turned out the invoices each contained a web address that had been taken offline. Once we removed the web address his invoices were able to successfully send. I suspect Microsoft opens the PDF and looks for web addresses then confirms they are valid."
2. By Chris Brown_879: "Our IT support had finally been able to make some progress on this, it took about 2 weeks of daily enquiries to Microsoft and getting the issue escalated to senior support. We removed all links from emails and signatures, following up emails from our domain with an email from a shared Gmail. We still do not know why this happened. My advice is keep on at Microsoft every day."
3. By Lance Selgo: "There is no solution other than Microsoft Support Engineers adding you to some white list, and/or removing you from a block/filtering list. It took me 6 months with them to get them to do it. I hope you are able to find a resolution quicker than I was."

So, I guess the major suggestion is that you contact Microsoft Online Tech support directly to escalate the issue. To do this, submit a support ticket through the Microsoft 365 admin center or by calling Microsoft support. Please make your ticket as detailed as you've done here, while including any relevant error messages or logs. Here's how to reach support:

1. Go to the admin center at https://admin.cloud.microsoft. If you get a message that says you don't have permission to access this page or perform this action, you aren't an admin. For more information, see Who has admin permissions in my business?.
2. On the bottom right side of the page, select Help & support.
3. Type a question or keyword into the text box. If you get a drop-down list, select the one closest to your question, or continue typing your question, then press Enter.
4. If the results don't help, at the bottom, select Contact Support.
5. Enter a description of your issue, confirm your contact number and email address, select your preferred contact method, and then select Contact me. The expected wait time is indicated in the Contact support pane.

Hope this helps you.

• Stephen N.