Internet Explorer classes my domains as phishing sites

Phishing

[JudgeJeffries]

Obviously not the right place to post this but could someone point me in the right direction and tell me where.
Need advice on why 4 .us.com websites that have a contact form are all suddenly categorized by IE as phishing websites (theyre not and have been unchanged for years) causing a massive collapse in visitor numbers.

[jdMorgan]

This isn't clear. How did you become aware of their categorization of your sites -- By visiting the forms yourself using IE? Or is this a site-wide categorization, meaning that you're on IE's domain blacklist?

Two possibilities are that some phishers have spoofed your domain names as the "Reply-to" address or link-text domain in their phishing e-mails, or perhaps your forms have been hacked. Depending on which of these occurred, you'll either want to contact MS's browser security team to inquire about getting off the blacklist, or perhaps contact your host or a security consultant for help cleaning up the forms on your server.

AFAIK, the #1 signal for a phishing site is that the domain shown in the link-text does not match the domain in the <href> http: or mailto: link itself. So be sure that your links and/or e-mail addresses match the link-text if you use that format either on your sites or in promotional e-mails.

Also, make sure you're not linking to your own sites using IP addresses and/or non-canonical domains names instead of the canonical domain names.

Jim

[Key_Master]

This happened to me once and all it took was a request for a correction and a couple of hours later the site was cleared.

[phishingfilter.microsoft.com...]

[JudgeJeffries]

JD - When you click on the website link the index page comes up for a second or two followed by a page headed 'This is a reported phishing website" with several options including a faciity to report it to MS if it an erroniuos warning.
What mystifies me is that I have 4 different .us.com domains, at different hosts and they've all been hit. They do share a common form.

[jdMorgan]

Well, click on the report erroneous warning link, and open a dialog with MS... If they'll tell you what the (potential) problem was, that would make for a very interesting thread here... :)

I wonder if a competitor could "do this to you."

Jim

[rocknbil]

Without previous knowledge, I would begin looking at how those forms are processed. Do you have the form processor logging input data?

My logic is, phishing is an email scheme. Your forms are the point of entry.

Server logs seldom tell the whole story on this. Any form processor should log user input data, and do so in a private location. If you get one of those "cool site!" spams every now and then, it's entirely possible they are using email injection to inject a BCC into the mail headers.

You get one email. AOL gets a thousand. This is significant.

[JudgeJeffries]

I've got a lot of websites using the exact same form but its only the us.com websites that have been hit.

[JudgeJeffries]

Mysteriously enough they have now all cleared and are all back to normal - how strange.