This afternoon, a user reported a suspicious website on our intranet, that is using microsoftstream.com.
After some analysis, it turns out the domain is currently redirecting to a sketchy website signed by "Ibiza99".
A quick WHOIS lookup shows that Microsoft still owns the domain, which makes this redirect even more puzzling.
I'm sharing this here in case others have come across the same behavior.
From a best practices standpoint, would you recommend permanently blocking this domain in our security suite to prevent users from landing on this page while trying to access Microsoft Stream content?
After some analysis, it turns out the domain is currently redirecting to a sketchy website signed by "Ibiza99".
A quick WHOIS lookup shows that Microsoft still owns the domain, which makes this redirect even more puzzling.
I'm sharing this here in case others have come across the same behavior.
From a best practices standpoint, would you recommend permanently blocking this domain in our security suite to prevent users from landing on this page while trying to access Microsoft Stream content?