Domain dracoon.cloud falsely classified as potentially malicious
Incident Report for DRACOON Cloud
Postmortem

What happened? Many dracoon.cloud were blocked by Google's Safe Browsing as a phishing website.
 
Why did this happen? Even though nobody knows how the Safe Browsing engines work, it is likely that some users reported a dracoon.cloud domain to Safe Browsing, which made Google to start analysing the whole domain and start blocking specific URLs. After a while, it blocked the whole DRACOON.cloud domain and subdomains, which could have affected every single paying customer without a dedicated CNAME.
 
What did we do? In a concerted effort, all customers were notified by a status page update. The reported URLs were manually checked for phishing content (nothing found). Many complaints to Google's Safe Browsing were submitted. 
 
What can we do to improve? Use the Google Search Console to detect similar incidents and send us notifications. Implement Gdata antivirus in the backend to detect and block attempts to upload phishing content.

Posted Sep 21, 2022 - 09:07 CEST

Resolved
The countermeasures have taken effect and the problem has not been observed in the last few days.
The incident is closed and further details will be released at a later time in the post mortem.
Posted Aug 25, 2022 - 10:37 CEST
Identified
Our domain dracoon.cloud was falsely classified as potentially malicious by Google Safe Browsing.
The issue was already reported and we are working on a solution.
Posted Aug 12, 2022 - 18:09 CEST
This incident affected: API (API (group 01)), Email and SMS (Instant messages), Previews (Preview delivery), and Authentication, Web App, Branding, WebDAV.