False positive My FQDN blocked by Microsoft Defender

[cwit]

Looks like all *.3cx.com.au FQDNs have been blocked by Microsoft Defender and 365 users are unable to click through to the webclient from the welcome email. This seems to have been occurring since around 11:30 UTC+10 today.



Customers using other TLDs such as *.3cx.co.uk or their own FQDNs don't seem to be affected.

Browsing to 3cx.com.au shows warnings as the cert expired last May, so I wonder if this is related to the blanket blacklisting. Maybe this is something 3CX can resolve ASAP. I have asked our 365 Admin to report as a false positive.

 

[TheodorosG_3CX]

Thank you for your report.
We have already contacted Vendor and we will inform you of their response as soon as they reply.

Our communication will remain transparent throughout this investigation.

 

[TheodorosG_3CX]

Also note that we have also deployed new machines from our side with an AU FQDN (**.3cx.com.au), configured MS365, then sent welcome emails successfully through MS365.
This is not a general issue but something specific your domain or MS has already cleared it.
If your persists you can login in your MS account / MS365 Defender dashboard / Submissions (https://security.microsoft.com/reportsubmission?viewid=url) and submit your FQDN as URL for analysis, with option "Should not have been blocked (False positive)", and "Allow this URL " for 30 days as per screenshot below:

 

[Charles_3CX]

Marking this as a false positive as per feedback already provided above since this is not a general issue but something specific to your domain.

If your issue persists, you can log in to your MS account / MS365 Defender dashboard / Submissions (https://security.microsoft.com/reportsubmission?viewid=url) and submit your FQDN as URL for analysis, with the option "Should not have been blocked (False positive)", and "Allow this URL " for 30 days.

 

[cwit]

This was not specific to our customer's domains, it affected all *.3cx.com.au domains as the SSL for 3cx.com.au had expired. Now that it has been renewed there is no longer an issue

Thank you for renewing the SSL