<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">As a side note, I've had 7 emails from AWS SES hosted domains trying to phish for information. Looks like there has been a spate of insecure systems again on the web being used by bad actors. It wouldn't shock me given the bucket issues also reported on as well that some dodgy phishing sites are being hidden behind cloud front. <div><br></div><div>As I found a heap behind Akamai. </div><div><br id="lineBreakAtBeginningOfSignature"><div dir="ltr">Sent from my iPhone</div><div dir="ltr"><br><blockquote type="cite">On 8 Feb 2025, at 08:48, Robert Hudson <hudrob@gmail.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="auto">As a follow-up.<div dir="auto"><br></div><div dir="auto">Yes, we raised a ticket with AWS for this.</div><div dir="auto"><br></div><div dir="auto">The compounding issue was that the IPs were then associated with a number of domains/sub-domains, some of which are not only presented via CloudFront, and it took some time to get agreement on this point.</div><div dir="auto"><br></div><div dir="auto">The IPs were removed, and security services are slowly backing down (we started with 7 services as tracked by VirusTotal marking us as malicious, it crept up to 12, its now down to 11).</div><div dir="auto"><br></div><div dir="auto">Hopefully we're on the path to redemption. But it's a slow journey.</div><div dir="auto"><br></div><div dir="auto">I suspect the longer term solution to prevent this occurring again is to move to static IP assignments where we use CloudFront - not exactly cheap, but cheaper than what's happened here.</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Fri, 7 Feb 2025, 2:29 pm Robert Hudson, <<a href="mailto:hudrob@gmail.com">hudrob@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><span style="font-size:12.8px">Hi all,</span><div dir="auto" style="font-size:12.8px"><br></div><div dir="auto" style="font-size:12.8px">Is anyone else seeing AWS CloudFront "fronted" domains being marked as malicious or hosting phishing?</div><div dir="auto" style="font-size:12.8px"><br></div><div dir="auto" style="font-size:12.8px">We have one domain being marked as such right now after four new IP addresses which were previously hosting malware and phishing attempts were apparently added by AWS to a pool used by CloudFront.</div><div dir="auto" style="font-size:12.8px"><br></div><div dir="auto" style="font-size:12.8px">It's causing quite the drama for us, was just wondering if it's a bit more widespread...</div></div>
</blockquote></div>
<span>_______________________________________________</span><br><span>AusNOG mailing list</span><br><span>AusNOG@lists.ausnog.net</span><br><span>https://lists.ausnog.net/mailman/listinfo/ausnog</span><br></div></blockquote></div></body></html>