topic MSFT Office365 Domain As Phishing? in General Topics

MSFT Office365 Domain As Phishing?

Brandon_Wertz — Wed, 02 Aug 2017 19:35:06 GMT

I was running a 228 PAN-DB version and have since noticed the content version updated. Did anyone else have any issues with Office365 services?

ME @firewall(active)> show running url secure.aadcdn.microsoftonline-p.com

DP dp0:

secure.aadcdn.microsoftonline-p.com phishing expires in 380 seconds

DP dp1:

secure.aadcdn.microsoftonline-p.com content-delivery-networks expires in 0 seconds

DP dp2:

secure.aadcdn.microsoftonline-p.com phishing expires in 0 seconds

Re: MSFT Office365 Domain As Phishing?

Brandon_Wertz — Wed, 02 Aug 2017 19:36:01 GMT

I opened a "Critical" ticket via support but haven't gotten a call back. I have a theory as to what might have a happened, but I need confirmation.

Re: MSFT Office365 Domain As Phishing?

oscaringosv — Thu, 03 Aug 2017 12:41:40 GMT

@Brandon_Wertz, let us know what they say.

Re: MSFT Office365 Domain As Phishing?

Brandon_Wertz — Wed, 02 Aug 2017 20:11:22 GMT

I don't want to speak for Palo Alto, so I'm not going to disclose much. Hopefully there'll be something released as an official statement.

Essentially the domain I posted was coming into PAN-DB as phisihing. That categorization was corrected and placed back into CDN.