<story><title>Ask HN: Microsoft SmartScreen is destroying our business</title><text>About a month ago, Microsoft SmartScreen suddenly started flagging the login page of our SaaS dashboard as &amp;#x27;unsafe&amp;#x27;, scaring away our customers.&lt;p&gt;We understand false flags can happen. So we took to the official SmartScreen feedback site to report the false flag (as the website owner). Received an email that stated it would take up to 24hrs to analyse: &amp;#x27;If the status of your site has not changed after 24 hours, please contact us with a reply to this message&amp;#x27;.&lt;p&gt;Sep 8 - first ticket sent.
Sep 9 (24h later) - nothing. So we replied to the message as instructed.
Sep 12 - still nothing. One more reply sent. Asked some of our customers to report our site as safe.
Sep 15 - crickets. Tried calling phone support, impossible to get through; they just hang up on us. Reached out to MS support on Twitter, said they would look into the case.
Sep 22 - no changes - MS twitter support has been unable to find the correct person internally. We replied to the SmartScreen ticket once more. Opened two new tickets. Asked more customers to report the site as safe.
Sep 30 (Today) - now the warning has started to spread from our login page to our entire dashboard. Still no word from Microsoft.&lt;p&gt;We are totally baffed that MS allows a false flag to stay up this long, totally ignoring us for almost a full month, meanwhile destroying a business that did nothing wrong...&lt;p&gt;We suspect one of our competitors is responsible for falsely reported us. Is &amp;#x27;weaponized SmartScreen&amp;#x27; a thing?&lt;p&gt;Does anyone have a similar experience? Any advince on resolving this matter is greatly appreciated!</text></story><parent_chain><item><author>lucb1e</author><text>Should they then not just reply with &amp;quot;You&amp;#x27;re on the list because of the malware payload at &amp;lt;URL&amp;gt;&amp;quot;?</text></item><item><author>jcrawfordor</author><text>Very important that you develop complete confidence that there isn&amp;#x27;t anything wrong with your product. It&amp;#x27;s not uncommon, in fact it&amp;#x27;s very common, for compromise kits for websites to take measures to avoid detection. A common one is only serving the malicious content when a specific referrer is present (I&amp;#x27;ve seen this be Yahoo Search in the case of compromised Drupal installations multiple times, not really sure why). It might be wise to engage a security firm to conduct an investigation if you don&amp;#x27;t have in-house expertise in this area. You should definitely review logs carefully for any unusual inbound traffic. Sometimes looking up your own domain on services like virustotal can reveal the problem, as it might turn up samples of malware retrieved from your website.&lt;p&gt;I say this because I have been involved in this exact situation multiple times: website flagged by some or other security service, website operator has no idea why and insists it is fine, website turns out to be serving the landing page of a major pharma scam campaign unnoticed by the website operator due to anti-detection measures.</text></item></parent_chain><comment><author>burnished</author><text>Just a guess, but I think they don&amp;#x27;t want to serve as an oracle for the people whose malware they are trying to block.&lt;p&gt;Not saying that isn&amp;#x27;t shit or frustrating.</text></comment>
<story><title>Ask HN: Microsoft SmartScreen is destroying our business</title><text>About a month ago, Microsoft SmartScreen suddenly started flagging the login page of our SaaS dashboard as &amp;#x27;unsafe&amp;#x27;, scaring away our customers.&lt;p&gt;We understand false flags can happen. So we took to the official SmartScreen feedback site to report the false flag (as the website owner). Received an email that stated it would take up to 24hrs to analyse: &amp;#x27;If the status of your site has not changed after 24 hours, please contact us with a reply to this message&amp;#x27;.&lt;p&gt;Sep 8 - first ticket sent.
Sep 9 (24h later) - nothing. So we replied to the message as instructed.
Sep 12 - still nothing. One more reply sent. Asked some of our customers to report our site as safe.
Sep 15 - crickets. Tried calling phone support, impossible to get through; they just hang up on us. Reached out to MS support on Twitter, said they would look into the case.
Sep 22 - no changes - MS twitter support has been unable to find the correct person internally. We replied to the SmartScreen ticket once more. Opened two new tickets. Asked more customers to report the site as safe.
Sep 30 (Today) - now the warning has started to spread from our login page to our entire dashboard. Still no word from Microsoft.&lt;p&gt;We are totally baffed that MS allows a false flag to stay up this long, totally ignoring us for almost a full month, meanwhile destroying a business that did nothing wrong...&lt;p&gt;We suspect one of our competitors is responsible for falsely reported us. Is &amp;#x27;weaponized SmartScreen&amp;#x27; a thing?&lt;p&gt;Does anyone have a similar experience? Any advince on resolving this matter is greatly appreciated!</text></story><parent_chain><item><author>lucb1e</author><text>Should they then not just reply with &amp;quot;You&amp;#x27;re on the list because of the malware payload at &amp;lt;URL&amp;gt;&amp;quot;?</text></item><item><author>jcrawfordor</author><text>Very important that you develop complete confidence that there isn&amp;#x27;t anything wrong with your product. It&amp;#x27;s not uncommon, in fact it&amp;#x27;s very common, for compromise kits for websites to take measures to avoid detection. A common one is only serving the malicious content when a specific referrer is present (I&amp;#x27;ve seen this be Yahoo Search in the case of compromised Drupal installations multiple times, not really sure why). It might be wise to engage a security firm to conduct an investigation if you don&amp;#x27;t have in-house expertise in this area. You should definitely review logs carefully for any unusual inbound traffic. Sometimes looking up your own domain on services like virustotal can reveal the problem, as it might turn up samples of malware retrieved from your website.&lt;p&gt;I say this because I have been involved in this exact situation multiple times: website flagged by some or other security service, website operator has no idea why and insists it is fine, website turns out to be serving the landing page of a major pharma scam campaign unnoticed by the website operator due to anti-detection measures.</text></item></parent_chain><comment><author>300bps</author><text>In this case, that sure would be helpful. Now imagine that you&amp;#x27;re running a website that is intentionally trying to trick people into installing malware. You&amp;#x27;ve successfully evaded tools like Smart Screen but now you&amp;#x27;ve ended up on the list.&lt;p&gt;You&amp;#x27;re not sure which one of your virus payloads set off their screen so you open a ticket. And Microsoft is supposed to tell you exactly how to get off their list again?</text></comment>