Microsoft’un Veri Merkezlerini Bloklaması ve Azure Networkünden Gelen Saldırıların Detayı

Microsoft’un Korona salgını yaşadığımız bugünlerde veri merkezlerine yaşattığı bazı sıkıntılar olduğu yazmıştık. Bu konudaki gelişmeleri Burayı tıklayarak okuyabilirsiniz.

Yazının çok uzun olmaması ve sadece merak edenlerin okuması için detayları bu sayfaya aldık. Aşağıda o yazıda anlattığımız sürecin detayını bulabilirsiniz.

Bloklama ve Saldırı ile İlgili Olayların Detayı

Bir de 3 bölüm halinde detayı anlatalım;

I – Bize Gelen Mesaj

Bizler, Türkiye’de faliyetlerini sürdüren, barındırdığı servisler ile binlerce web sitesine ve e-posta adresine ev sahipliği yapan servis sağlayıcılarız.

Yıllardır olduğu gibi pandemi süresince de halkın dijital iletişimini ayakta tutmak için canla başla çalışmaktayız. Dijital iletişimde önemli yer tutan e-posta trafiğinin sorunsuz işletilebilmesi için sürekli yatırımlar yapmaktayız.

Ancak yaklaşlık 3 aydır Microsoft tarafından Türk Servis Sağlayıcılara uygulanan engelleme ile karşı karşıyayız. Sistemlerimizin internet ağındaki teknik adresine konulan topyekün engelleme ile ağımızdan microsoft servislerine e-posta gönderimi yapılması engellenmektedir. Bunun anlamı müşterilerimizin e-postalarının yerine ulaşamamasıdır.

Konuyu Microsoft’a ilettiğimizde ise yapılan engellemenin sebebi ve çözümü tarafımıza sunulmamaktadır. Üstelik onların istedikleri yöntemler ile iletişim kuruyoruz.

06 Temmuz 2019 Tarihli Resmî Gazete Sayı: 30823 “Konu: Bilgi ve İletişim Güvenliği Tedbirleri” genelgesinde kamunun e-posta hizmetini ülke içinde tutması talep edilmesine karşın kamuda özellikle üniversitelerin halen ABD’ye yerleşik şirketlerden e-posta hizmeti aldığı tarafımızdan takip edilmektedir.

Kamunun ve özel sektörün e-posta trafiğini yurtdışında yerleşik bu şirketlerde tutmasın nedeniyle şirketler ellerindeki güç ile ülke içinde yerleşik biz yerel servis sağlayıcılara sebepsiz engellemeler uygulayabilmektedir.

Yine Microsoft ağından yerli servis sağlayıcıları hedefler şekilde kaynağı belli siber saldırılar yapılmakta ve Microsoft yine bu saldırılara önlem almayarak ve bildirilen ihlalleri çözmeyerek dijital iletişimin engellenmesi sebep olmaktadır.

Endüstri 4.0 ve dijitalleşmenin bel kemiği dijital haberleşmede %100 millileşme için genelde belirtilmesine rağmen süren ihlallerin durdurulması ve Microsoft’un yerel servis sağlayıcılara uyguladığı bu engellemenin kaldırılması ve ağından yerli servis sağlayıcılara yönelik yapılan saldırıların durdurulmasını talep etmekteyiz.

II – Microsoft’a Bizden Giden Sualler ve Gelen Cevap

Önce bizden 6 haziranda Microsoft’un Türkiye’deki halkla ilişkiler ajansına giden soruları verelim;

Merhaba
Veri merkezi sağlayıcılarından garip bir bilgi aldık. Yaklaşık 3 aydır Türk barındırma şirketlerine ait IP bloklarının tamamının live, outlook, hotmail sistemlerine e-posta gönderemediği söyleniyor. Ayrıca Microsoft ağından yoğun siber saldırı geldiği bilgisi de var.

Servis sağlayıcılar kendilerinin Microsoft’a çeşitli başvurular yaptıklarını hatta şirketin istediği formatta da yaptıkları halde cevap alamadıklarını belirtiyorlar.

Biz de bu konuda bir haber hazırlamaya başladık.Microsoft firmasına da aşağıdaki sorularımız var. Eğer cevaplar çarşamba gününe kadar yetişirse, haberimiz o yönde olur. Yetişmezse, bu bir şikayet haberi olur..

Sorularımız şöyle;

1. Microsoft’un bu yönde bir kararı ve engellemesi bulunuyor mu?

2. IP adresleri bloklanan servis sağlayıcıların, sadece spam şikayeti olan değil kendilerine ait tüm IP aralıklarının bloklandığını ve dönen hata mesajında da bu konuda teknik not dönüldüğü bilgisini veriyorlar. Eğer bir istenmeyen e-posta gönderimi var ise neden sadece sorunlu IP adresi engellenmiyor?

3. Engellenen e-posta trafiği Google, Yandex gibi dünyadaki diğer toplu e-posta hizmeti sunan servislere gönderilebiliyorken neden aynı sistemler Microsoft’a ait sistemlere(live, office 360) e-posta gönderilemiyor?

4. Uzun süredir Microsoft Azure, bulut sunucu sistemlerinden Türk servis sağlayıcılara sistematik olarak yapılan siber saldırılarla ilgili önlem alınmadığı şikayeti de var.Sadece bir servis sağlayıcıya… Microsoft ağından yapılan siber saldırılar ile ilgili olarak Nisan 2019 – Haziran 2020 tarihleri arasında 12.000 den fazla şikayet kaydı oluşturduğu ancak dönen yanıtların genel geçer olduğu ve saldırıların devam ettiği bildiriliyor (kayıtlarını vere biliyorlar). Ağınızdan Türk servis sağlayıcılara yapılan siber saldırı konusunda önlem almıyor musunuz?

Iyi calismalar
Fusun Nebil

Şimdi Microsoft’un cevabına bakalım;

Yukarıda bahsettiğim boş ve geçiştirici cevap şöyleydi;

Füsun hanım merhaba,
Nasılsınız?
Globalden gelen açıklamayı aşağıda görebilirsiniz.
Bu beyanı onay sürecimizden geçirdik:
“Antispam işlevlerimiz, müşterileri istenmeyen ve kötü amaçlı e-postalardan korumak için tasarlanmış birden çok faktöre dayanmaktadır. Daha fazla bilgiyi burada bulabilirsiniz. ”-here.

Ek bilgi:

Türk İSS’lerinde örtülü bir blok yok.Hizmetlerinin yanlış bir şekilde engellendiğine inanan kullanıcılar buradan bizimle iletişim kurabilir.here.

Bilginize

İyi akşamlar

III – 3 Aydır Microsoft’a İletilen Şikayet Başvuruları ve Gelen Bazı Cevaplar

Şimdi de olayın ciddiyetini gösteren bazı başvurulara ve Microsoft’tan gelen cevap maillerinden bazılarına bakalım. Bunları okurken, 3 aydır sürdüğünü, hepsini veremeyeceğimiz için en yakın tarihli olanları sunduğumuzu aklınızda tutun lütfen. Aşağıda 6 firmanın Microsoft ile 3 aydır sürdürdüğü güreşin detayını okuyalım birlikte (uzun ama olayı görmek açısından ilginç);

1. VERİ MERKEZİ

Cyber Defense Operations Center
Computer Emergency Response Team
Case Closure Notification
Case information SIR1387130
This message is to notify you that the Computer Emergency Response Team has reviewed your reported issue and has actioned it appropriately.
The activity reported is associated with a customer account within the Microsoft Azure service. Microsoft Azure provides a cloud computing platform in which customers can deploy their own software applications. Customers, not Microsoft, control what applications are deployed on their account.

The specific details of this case will not be provided in accordance with our customer privacy policy. Microsoft is continuously refining its systems to detect and prevent abuse of its online services. For more information about Microsoft Azure, visithttps://azure.microsoft.com/en-us.

Thank you,
Computer Emergency Response Team
[email protected]
About this notice
This notification is part of the Microsoft Computer Emergency Response Team standard operating procedure for handling reports of suspected abuse. Reports of suspected abuse can be filed directly athttp://cert.microsoft.com. Microsoft respects your privacy. Please read our Privacy Statement:http://www.microsoft.com/privacystatement/en-us/OnlineServices/Default.aspx.
One Microsoft Way, Redmond, WA 98052 USA
Ref:MSG0414938_hIjkrwhkQ392R0nCIFza

2. VERİ MERKEZİ

Cyber Defense Operations Center
Computer Emergency Response Team
Case Closure Notification
Case information
SIR1387130
This message is to notify you that the Computer Emergency Response Team has reviewed your reported issue and has actioned it appropriately.

The activity reported is associated with a customer account within the Microsoft Azure service. Microsoft Azure provides a cloud computing platform in which customers can deploy their own software applications. Customers, not Microsoft, control what applications are deployed on their account.

The specific details of this case will not be provided in accordance with our customer privacy policy. Microsoft is continuously refining its systems to detect and prevent abuse of its online services. For more information about Microsoft Azure, visithttps://azure.microsoft.com/en-us.
Thank you,
Computer Emergency Response Team [email protected]
About this notice
This notification is part of the Microsoft Computer Emergency Response Team standard operating procedure for handling reports of suspected abuse. Reports of suspected abuse can be filed directly athttp://cert.microsoft.com. Microsoft respects your privacy. Please read our Privacy Statement:http://www.microsoft.com/privacystatement/en-us/OnlineServices/Default.aspx.
One Microsoft Way, Redmond, WA 98052 USA
Ref:MSG0414938_hIjkrwhkQ392R0nCIFza

3. VERİ MERKEZİ

From:Hotmail Sender Support [mailto:WINLV.EDFS.WW.00.EN.CVG.BGL.TS.T03.ESC.00.EM@css.one.microsoft.com]
Sent:Monday, June 1, 2020 3:59 PM
To: ……
Subject:RE: SRX1502033805ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1502033805ID
Hello,

As previously stated, your IP (…..) do not qualify for mitigation at this time. I do apologize, but I am unable to provide any details about this situation since we do not have the liberty to discuss the nature of the block.

At this point, I would suggest that you review and comply with Outlook.com’s technical standards. This information can be found athttps://postmaster.live.com/pm/postmaster.aspx

We regret that we are unable to provide any additional information or assistance at this time.

Best regards,

P……..
Outlook.com Deliverability Support

— Original Message —
From : …..
Sent: Monday, June 1, 2020 10:05:20 AM UTC
To: “Hotmail Sender Support”
Subject: RE: SRX1502033805ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1502033805ID

Hello Sachin,

Thank you for information about ip blocked.

We alreayd register to JMRP SNDS program, when any ip sent to bulk e-mail to Hotmail we got to notfication.

This ………. ip range is not used any server a long time all space is empry and clean. Also we chek to all reports https://sendersupport.olc.protection.outlook.com/snds/datano ip sent to e-mail.

We found to …. this ip rande some spam/scam user sent to e-mail to Hotmail . We terminate costumer account closed SMTP ports.

I need unblock this range thank you.

From:Hotmail Sender Support [mailto:WINLV.EDFS.WW.00.EN.CVG.BGL.TS.T03.ESC.00.EM@css.one.microsoft.com]
Sent:Monday, June 1, 2020 3:04 AM
To: …..
Subject:RE: SRX1502033805ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1502033805ID

Hello,

My name is S….n and I work with the Outlook.com Deliverability Support Team.

YourIP(s) ……..was blocked by Outlook.com because Hotmail customers have reported email from this IP as unwanted. One possible explanation for this is the automatic forwarding of unfiltered inbound messages, including unwanted messages, to Outlook.com/MSN addresses.

Please confirm that your emails comply with Hotmail’s technical standards. This information can be found athttps://postmaster.live.com/pm/postmaster.aspx.

For more detailed information about best sending practices to Outlook.com users, please review the following white paper:http://download.microsoft.com/download/e/3/3/e3397e7c-17a6-497d-9693-78f80be272fb/enhance_deliver.pdf.

Sincerely,

Sachin

Outlook.com Deliverability Support

— Original Message —
From : ….

Sent: Sunday, May 31, 2020 8:00:59 PM UTC
To: “Hotmail Sender Support”
Subject: Re: SRX1502033805ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1502033805ID

Dear Bikash, My name is …

Thank you for information i can explain for you.

Date(s) this compromise occurred:19-22 May , we found problem investigate

Brief description of the compromise:investigate to ip block scam or spam costumer.

Brief description of what was done to resolve the compromise;After the problem we investigate to our IP range . this ip range not use to a long time. This is is all clean. No one use to this ip range you can see on your system.

Also we check to this ip range …. our “sender support sdns” panel this ip range is clean.

So,

We are engineer and tech guys you know. we have no chance to verify every customer you know. but we do our best in this regard. we absolutely do not allow spam on my own network.

For now Hotmail blocked our all IP range i dont know what we do. we need to help this. Our costumers also your users. We need to work together. these harmful customers hurt you too. we shouldn’t allow this.

we shut down the services of customers we detected spam. we took our precautions in this matter and we will be more careful.

Now we have to solve the problems of thousands of customers who have no crime. In this time of epidemic, people communicate by e-mail and we have to help them. Please unblock our network range.

Thank you for understand

Kimden:Hotmail Sender Support <WINLV.EDFS.WW.00.EN.CVG.BGL.TS.T03.ESC.00.EM@css.one.microsoft.com>
Tarih:31 Mayis 2020 Pazar 22:35
Kime:
Konu:RE: SRX1502033805ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1502033805ID

Hello,

My name is Bikash and I work with the Outlook.com Deliverability Support Team.

Thank you for contacting us regarding your current deliverability issue. You are reporting that this is due to a recent compromise that took place on your system. Can you please provide the following details to help us with our investigation?

Date(s) this compromise occurred:

Brief description of the compromise:

Brief description of what was done to resolve the compromise:

Thank you for providing us with this information.

Sincerely,

Bikash

Outlook.com Deliverability Support

— Original Message —
From :
Sent: Sunday, May 31, 2020 6:13:01 PM UTC
To: “WINLV.EDFS.WW.00.EN.MSF.RMD.TS.T01.SPT.00.EM@css.one.microsoft.com”
Subject: [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1502033805ID

Hello team, My name is ….

Thank you for information i can explain for you.

We know Hotmail policy and i understandant that. Also i have alreayd registered Junkmail program and SDNS.

This problem occurred without our knowledge. we are a company that has been providing server and hosting services for 10 years.

We check last 10 days “https://sendersupport.olc.protection.outlook.com/snds/data.aspx” our panel ……. is all clear not sent to any spam or scam. Also we dont got any report this ip range you check SDNS reporting.

What we do:

After spam problems we check all ip adress. We found it ….. using net range some costumers sent to tousands mail to Hotmail. We closed their ip adress and closed SMTP port also. We comminicate costumers and warn and terminated services permanents.

We are engineer and tech guys you know. we have no chance to verify every customer you know. but we do our best in this regard. we absolutely do not allow spam on my own network.

For now Hotmail blocked our all IP range i dont know what we do. we need to help this. Our costumers also your users. We need to work together. these harmful customers hurt you too. we shouldn’t allow this.

we shut down the services of customers we detected spam. we took our precautions in this matter and we will be more careful.

Now we have to solve the problems of thousands of customers who have no crime. In this time of epidemic, people communicate by e-mail and we have to help them. Please unblock our network range.

Thank you for understand

Network Administrator and Founder

Kimden:“WINLV.EDFS.WW.00.EN.MSF.RMD.TS.T01.SPT.00.EM@css.one.microsoft.com” <WINLV.EDFS.WW.00.EN.MSF.RMD.TS.T01.SPT.00.EM@css.one.microsoft.com>
Tarih:31 Mayis 2020 Pazar 20:52
Kime:
Konu:Reported deliverability problem to Outlook.com SRX1502033805ID

Dear

We have completed reviewing the IP(s) you submitted. The following table contains the results of our investigation.

Not qualified for mitigation
…………
Our investigation has determined that the above IP(s) do not qualify for mitigation.

Please ensure your emails comply with the Outlook.com policies, practices and guidelines found here:http://mail.live.com/mail/policies.aspx.

To have Deliverability Support investigate further, please reply to this email with a detailed description of the problem you are having, including specific error messages, and an agent will contact you.

Regardless of the deliverability status, Outlook.com recommends that all senders join two free programs that provide visibility into the Outlook.com traffic on your sending IP(s), the sending IP reputation with Outlook.com and the Outlook.com user complaint rates.

Junk Email Reporting program (JMRP) When an Outlook.com user marks an email as “junk”, senders enrolled in this program get a copy of the mail forwarded to the email address of their choice. It allows senders to see which mails are being marked as junk and to identify mail traffic you did not intend to send. To join, please visithttp://support.msn.com/eform.aspx?productKey=edfsjmrpp&page=support_home_options_form_byemail&ct=eformts.

Smart Network Data Services program (SNDS). This program allows you to monitor the ‘health’ and reputation of your registered IPs by providing data about traffic such as mail volume and complaint rates seen originating from your IPs. To register, please visithttp://postmaster.live.com/snds/.

There is no silver bullet to maintaining or improving good IP reputation, but these programs help you proactively manage your email eco-system to help better ensure deliverability to Outlook.com users.

Thank you,

Outlook.com Deliverability Support

VERİ MERKEZİ – IV

Buradan giden 41 mailing var ama biz sadece 1 tanesini yayınlıyoruz..

From:Microsoft Customer Support <SENDS.EDFS.WW.00.EN.CVG.BGL.SF.T03.ESC.00.EM@css.one.microsoft.com>
Sent:Friday, May 22, 2020 11:55 PM
To: ….
Cc: ……
Subject:RE: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hello,

My name is S.R. and I work with the Outlook.com Deliverability Support Team.

We have implemented mitigation for your IP’s …..and this process may take 24 – 48 hours to replicate completely throughout our system.

Sincerely,

S.R.

Outlook.com Deliverability Support.

— Original Message —
From :
Sent: Tuesday, May 19, 2020 8:02:23 PM UTC
To: “Microsoft Customer Support”
Cc :
Subject: Re: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hi dear,

I have some ideas and I’m going to transfer it to you with MS Teams. to request a meeting with ….. Please let me know.

Regards.

Kimden:Microsoft Customer Support <SENDS.EDFS.WW.00.EN.CVG.BGL.SF.T03.ESC.00.EM@css.one.microsoft.com>
Tarih:19 Mayis 2020 Sali 22:06
Kime:
Bilgi:
Konu:RE: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID
Hello,
Thank you for your response.
We have conducted our investigation and applied the required mitigation (Delisted from Blocklist) for your IP’s: …. This process may take24 – 48 hoursto replicate completely throughout our system.

Thank you

Outlook.com Deliverability Support

— Original Message —
From :
Sent: Tuesday, May 19, 2020 6:50:19 PM UTC
To: “Microsoft Customer Support”
Cc :
Subject: Re: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hi all,

we are already members of the JMRP and SDNS program and follow from there. Please my IP’s ……
delist from your Blocklist. which IP did you see an event from? because you blocked all my IP’s.
ASAP.
@E

Bu yazismalari 1 aydir yapiyorum, tekrar tekrar ayni sorular soruluyor ve hiçbir sekilde yanit alamiyorum. Bahsi geçen programlara zaten üyeyiz,[email protected]adresine hotmail, msn, outlook veya office 365 ten gelen bir bildirim de yok. 4 yildir aktif olmayan ip adresimi bile bloklamislar. Sunucularin mail trafik çikislarina da bakiyorum, herhangi bir SPAM yada Phising Attack trafigi görmüyorum.

Gerçekten çok zor duruma soktu bu islem bizi, müsteri kaybetmeye basliyorum.

Ilginiz ricadir.

Kimden:Microsoft Customer Support <SENDS.EDFS.WW.00.EN.CVG.BGL.SF.T03.ESC.00.EM@css.one.microsoft.com>
Tarih:19 Mayis 2020 Sali 20:17
Kime:
Bilgi:
Konu:RE: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hello,

Recent activity coming from your IP …… has been flagged by our system as suspicious, causing your IP to become blocked. I have conducted an investigation into the emails originating from your IP space and have implemented mitigation for your deliverability problem. This process may take24 – 48 hoursto replicate completely throughout our system.

Please note that lifting the block does not guarantee that your email will be delivered to a user’s inbox. However, here are some things that can help you with delivery:

• Join the Junk Mail Reporting Program (JMRP)

We believe that your recipients are the best indicator that the email you are sending is wanted. The JMRP program allows you to see which of your emails Outlook.com users have marked as junk or unwanted mail. Reviewing the results in JMRP will provide to the most direct information on what characteristics of your email, customers, and ultimately SmartScreen®, consider to be unwanted. This helpful feedback mechanism allows you to ensure that mails being sent from your IP are not resulting in negative feedback that could impact your sending reputation. Being vigilant about users who mark your e-mail as unwanted or the types of messages that are being marked as unwanted can help you keep mailing lists updated with only interested users and modify future campaigns. In addition, monitoring user complaints can help you identify unintended mail traffic or detect a potentially compromised account sending unwanted mail to your customers. Enroll athttps://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0.

• Join the Smart Network Data Services program (SNDS)

The SNDS program provides data about traffic seen originating from your registered IP, such as mail volume and complaint rates. The data is built from the log files of the inbound mail machines and other servers at Outlook.com and Microsoft and represents factual information about the traffic from your mail servers to Outlook.com users. This is a service that helps legitimate email senders work with their customers and partners to reduce spam originating from their IP. This program allows a sender to monitor the ‘health’ of their IPs. For more information about this free program refer tohttps://postmaster.live.com/snds/FAQ.aspx. To register, please go tohttp://postmaster.msn.com/snds/. (Tip: As part of the enrollment process, you are asked to sign the JMRP program agreement and then send a response to Support indicating that it has been signed. It’s not uncommon for that step in the enrollment process to be missed.)

NOTE: The SNDS tool and/or enrollment in the JMRP will not allow emails from your mail servers to bypass our filters, these are in place to help legitimate companies deliver their emails to Outlook.com customers.

• Apply for the Sender Score Certified Mail program
  If you are doing all the above and you continue to have deliverability issues, you may wish to consider joining the Sender Score Certified Mail Program, a third party program administered by Return Path, Inc. Many legitimate mailers and marketers have qualified and joined this program to improve mail deliverability and decrease email from being filtered to the Junk E-mail Folder. Sender Score (https://returnpath.com/solutions/email-deliverability-optimization/ip-certification/) is the only service to which we subscribe

The troubleshooting steps in this email are recommendations only. Microsoft makes no guarantees that following these steps will guarantee deliverability to Hotmail, MSN, Outlook.com, or Live.com customers.

For more detailed information about best sending practices to Outlook.com users, please review the following white paper:http://download.microsoft.com/download/e/3/3/e3397e7c-17a6-497d-9693-78f80be272fb/enhance_deliver.pdf

Sincerely,

M….
Outlook.com Deliverability Support

— Original Message —
From :
Sent: Sunday, May 17, 2020 6:47:17 PM UTC
To: “Microsoft Customer Support”
Subject: Re: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hello

My new ip your bloklist. … what is your problem ?

Kimden:Microsoft Customer Support <SENDS.EDFS.WW.00.EN.CVG.BGL.SF.T03.ESC.00.EM@css.one.microsoft.com>
Tarih:12 Mayis 2020 Sali 17:28
Kime:
Konu:RE: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hello,

My name is S.. and I work with the Outlook.com Deliverability Support Team.

I have received your request for an investigation into your IP address … Please submit the IP through the automation system in order to start the mitigation process. This is the quickest way to gather information regarding your IP address. To do this please complete the form at the following link: http://go.microsoft.com/fwlink/?LinkID=614866

This will allow our automation system to analyze your IP and determine if the issue can be resolved quickly. You will be notified via email of the results. If the IP does not qualify for automatic mitigation, or more information is needed, you will be provided the instructions you will need to follow to have the issue investigated further.

Thank you,

S..

Outlook.com Deliverability Support

— Original Message —
From :
Sent: Tuesday, May 12, 2020 8:41:12 AM UTC
To: “Microsoft Customer Support”
Subject: Re: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hi,

Problem is not finished. … ip not send hotmail.com, please help me.

— Original Message —
From :
Sent: Friday, May 8, 2020 9:40:30 AM UTC
To: “Microsoft Customer Support”
Subject: Re: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hi,

Can’t see an improvement in my IP address status.

Kimden:Microsoft Customer Support <SENDS.EDFS.WW.00.EN.CVG.BGL.SF.T03.ESC.00.EM@css.one.microsoft.com>
Tarih:6 Mayis 2020 Çarsamba 06:41
Kime:
Konu:RE: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hello,

Recent activity coming from your IPs

(….

…..

…..

…..) has been flagged by our system as suspicious, causing your IP to become blocked. I have conducted an investigation into the emails originating from your IP space and have implemented mitigation for your deliverability problem. This process may take 24 – 48 hours to replicate completely throughout our system.

Please note that lifting the block does not guarantee that your email will be delivered to a user’s inbox. However, here are some things that can help you with delivery:

• Join the Junk Mail Reporting Program (JMRP)

We believe that your recipients are the best indicator that the email you are sending is wanted. The JMRP program allows you to see which of your emails Outlook.com users have marked as junk or unwanted mail. Reviewing the results in JMRP will provide to the most direct information on what characteristics of your email, customers, and ultimately SmartScreen®, consider to be unwanted. This helpful feedback mechanism allows you to ensure that mails being sent from your IP are not resulting in negative feedback that could impact your sending reputation. Being vigilant about users who mark your e-mail as unwanted or the types of messages that are being marked as unwanted can help you keep mailing lists updated with only interested users and modify future campaigns. In addition, monitoring user complaints can help you identify unintended mail traffic or detect a potentially compromised account sending unwanted mail to your customers. Enroll athttps://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0.

• Join the Smart Network Data Services program (SNDS)

The SNDS program provides data about traffic seen originating from your registered IP, such as mail volume and complaint rates. The data is built from the log files of the inbound mail machines and other servers at Outlook.com and Microsoft and represents factual information about the traffic from your mail servers to Outlook.com users. This is a service that helps legitimate email senders work with their customers and partners to reduce spam originating from their IP. This program allows a sender to monitor the ‘health’ of their IPs. For more information about this free program refer tohttps://postmaster.live.com/snds/FAQ.aspx. To register, please go tohttp://postmaster.msn.com/snds/. (Tip: As part of the enrollment process, you are asked to sign the JMRP program agreement and then send a response to Support indicating that it has been signed. It’s not uncommon for that step in the enrollment process to be missed.)

NOTE: The SNDS tool and/or enrollment in the JMRP will not allow emails from your mail servers to bypass our filters, these are in place to help legitimate companies deliver their emails to Outlook.com customers.

• Apply for the Sender Score Certified Mail program
  If you are doing all the above and you continue to have deliverability issues, you may wish to consider joining the Sender Score Certified Mail Program, a third party program administered by Return Path, Inc. Many legitimate mailers and marketers have qualified and joined this program to improve mail deliverability and decrease email from being filtered to the Junk E-mail Folder. Sender Score (https://returnpath.com/solutions/email-deliverability-optimization/ip-certification/) is the only service to which we subscribe

The troubleshooting steps in this email are recommendations only. Microsoft makes no guarantees that following these steps will guarantee deliverability to Hotmail, MSN, Outlook.com, or Live.com customers.

For more detailed information about best sending practices to Outlook.com users, please review the following white paper:http://download.microsoft.com/download/e/3/3/e3397e7c-17a6-497d-9693-78f80be272fb/enhance_deliver.pdf

Sincerely,

S….
Outlook.com Deliverability Support

— Original Message —
From :
Sent: Wednesday, May 6, 2020 3:09:42 AM UTC
To: “Hotmail Sender Support”
Subject: Re: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

can someone answer this problem continues

Kimden:Hotmail Sender Support <WINLV.EDFS.WW.00.EN.CVG.BGL.TS.T03.ESC.00.EM@css.one.microsoft.com>
Tarih:5 Mayis 2020 Sali 01:20
Kime:
Konu:RE: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hello,

My name is B…. and I work with the Outlook.com Deliverability Support Team.

We will be looking into this issue along with the Escalations Team with the IP’s: (….. , ……., ……. , …….). We understand the urgency of this issue and will provide an update as soon as this is available. Rest assured that this ticket is being tracked and we will get back to you as soon as we have more information to offer.

Thank you for your patience.

Sincerely,
B..
Outlook.com Deliverability Support

— Original Message —
From :
Sent: Monday, May 4, 2020 7:59:14 PM UTC
To: “Hotmail Sender Support”
Subject: Re: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hi,

I think this process is unfair. this was done intentionally and by rival service. you believe too.

Our servers have antispam and security. Please check SPF, DMARC, DKIM, RDNS from my ip address.

Now all I want is you to befair.

Kimden:Hotmail Sender Support <WINLV.EDFS.WW.00.EN.CVG.BGL.TS.T03.ESC.00.EM@css.one.microsoft.com>
Tarih:4 Mayis 2020 Pazartesi 22:41
Kime:
Konu:RE: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hello,

My name is R… and I work with the Outlook.com Deliverability Support Team.

Your IPs (18 IP adresi var burada) was blocked by Outlook.com because Hotmail customers have reported email from this IP as unwanted. One possible explanation for this is the automatic forwarding of unfiltered inbound messages, including unwanted messages, to Outlook.com/MSN addresses.

Please confirm that your emails comply with Hotmail’s technical standards. This information can be found athttps://postmaster.live.com/pm/postmaster.aspx.

For more detailed information about best sending practices to Outlook.com users, please review the following white paper:http://download.microsoft.com/download/e/3/3/e3397e7c-17a6-497d-9693-78f80be272fb/enhance_deliver.pdf.

Sincerely,

R…

Outlook.com Deliverability Support

— Original Message —
From :
Sent: Tuesday, May 5, 2020 12:59:13 AM UTC
To: “Hotmail Sender Support”
Subject: Re: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hi Sa…..

All problems IP address is there. Please help me, RNDS, SPF, DKIM and DMARC registered is not problem. I have checked inmxtoolbox.com, and not see problem. Why this ip’s in your (Hotmail, msn, Outlook) list?

(20 IP adresi)

Kimden:Hotmail Sender Support <WINLV.EDFS.WW.00.EN.CVG.BGL.TS.T03.ESC.00.EM@css.one.microsoft.com>
Tarih:4 Mayis 2020 Pazartesi 20:12
Kime:online bilisim – destek ekibi <[email protected]>
Konu:RE: SRX1500189301ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hello,

My name is S.. and I am with the Outlook.com Deliverability Support Team.

As we see you have submitted more than 256 IPs. Please note our issue submission form allows up to 256(/24) IPs per ticket.

Performing a preliminary investigation before submission will help us to address your issues more efficiently. Please only submit IP addresses that receive errors indicating a deliverability issue.

Thank you,

Sachin

Outlook.com Deliverability Support

— Original Message —
From :
Sent: Monday, May 4, 2020 3:02:07 PM UTC
To: “WINLV.EDFS.WW.00.EN.MSF.RMD.TS.T01.SPT.00.EM@css.one.microsoft.com”
Subject: [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1500189301ID

Hello

I don’t understand you.

Kimden:<WINLV.EDFS.WW.00.EN.MSF.RMD.TS.T01.SPT.00.EM@css.one.microsoft.com>
Tarih:4 Mayis 2020 Pazartesi 17:55
Kime:
Konu:Reported deliverability problem to Outlook.com SRX1500189301ID

Dear …

Please note that your ticket number is in the subject line of this mail.

(19 IP adresi)

Note: Errors are unlikely, however, if an error is indicated, please resubmit the specific IP or IP range.

Thank you,

Outlook.com Deliverability Support

Please do not reply to this message as it is from an unattended mailbox. Any replies to this email will not be responded to or forwarded. This service is used for outgoing emails only and cannot respond to inquiries.

VERİ MERKEZİ – V

Kimden:“Hotmail Sender Support” <WINLV.EDFS.WW.00.EN.CVG.BGL.TS.T03.ESC.00.EM@css.one.microsoft.com>
Kime:
Gönderilenler:3 Haziran Çarşamba 2020 21:36:39
Konu:RE: SRX1502004286ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1502004286ID

Hello,

We have investigated your deliverability issue regardingIP’s: ……….At the current time, this IP is not eligible for mitigation.

We are concerned with a pattern of irregular mail traffic originating from your IP. While this could be benign, sudden changes in email sending volume can be the result of a server or network compromise or the result of compromised user accounts.

It takes time to improve IP reputation and careful vigilance of your email systems which includes monitoring the information you can receive from server logs and programs such as JMRP and/or SNDS to help identify potential issues, such as compromised servers or accounts, spikes in sending overall volume etc. There is no silver bullet, unfortunately, to improve or maintain IP reputation.

While we cannot offer mitigation at this time, please note that our technologies designed to prevent unwanted mail are not static and will respond to changes in sending practices over time. In addition to the best practices we have already recommended, here are some specific recommendations for you to consider:

• Review outbound mail logs– It’s recommended that you have network and email admins review server logs for anomalies and verify all of the email sending is intentional. Be aware that not all compromises immediately result in a high volume of mail. Some attacks may be more subtle, and may only periodically send mail from infected mail servers. Therefore, careful log review may be necessary to detect and address potential compromise issues. As a best practice, set up monitoring on outbound sending volume to ensure that sudden, unexpected peaks are quickly identified and reviewed.
• Security review of sending servers –In addition, it’s recommended you ensure all sending servers are up-to-date with the latest security patches, updates, etc. and that security and anti-virus scans are regularly executed against all sending servers.
• Implement Sending Limits –It’s a recommended best practice to enforce sending limits on your domain accounts; this is a simple method to prevent users who may be compromised from sending bulk emails and helps better protect the reputation? of your IPs.

In addition, Microsoft has several programs which can assist you with identifying and monitoring potential issues, such as compromised servers, outdated mailing lists, etc.Joining these programs does not mean you are whitelisted from Outlook.com. Here are some specific recommendations for you to consider:

 

• Actively monitor your junk mail reports– The free JMRP program (http://mail.live.com/mail/services.aspx) provides reports on junk email reported by Outlook.com customers for your IP addresses. This helpful feedback mechanism allows you to ensure that mails being sent on your IPs are not resulting in negative feedback that could impact your sending IP reputation. Being vigilant about users who mark your e-mail as unwanted (or junk) or the types of messages that are being marked as unwanted (or junk) can help you identify unintended mail traffic, modify future campaigns and keep mailing lists updated with only interested consumers. You can Enroll at

https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0

 

• Actively Monitor IP Traffic– Consider joining the Smart Network Data Services program (SNDS). This free program provides data about traffic seen originating from your registered IPs, such as mail volume and complaint rates. The data is built from the log files of the inbound mail machines and other servers at Outlook.com and Microsoft and represents factual information about the traffic from your mail servers to Outlook.com users. For more information about this free program refer tohttps://postmaster.live.com/snds/FAQ.aspx. To register, please go tohttp://postmaster.msn.com/snds/.

 

Sincerely,

H..

Outlook.com Deliverability Support

 

— Original Message —
From :
Sent: Wednesday, June 3, 2020 4:54:34 PM UTC
To: “Hotmail Sender Support”
Subject: Re: SRX1502004286ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1502004286ID

Hello there,

Thank you for returning to our application. We have made some studies in line with the information you provided and we continue to do so. We are a very small hosting / server company. The fact that our customers’ e-mails do not reach Microsoft-based e-mail services leaves us in a very difficult situation. We are trying to improve our systems according to your suggestions. If possible, we ask you to unblock. We will constantly monitor the systems and work for clean email traffic output.

1) We are a member of RIPE. We have 4 C Class IP blocks. We have registered with SNDS for each of these.
2) We have registered to the JMRP program and we follow this program.
3) We have set up the necessary firewall and spam filters for the servers in our network.
4) We set up antispam / antivirus gateways for Outgoing emails and started to direct our email traffic to these gateways. (This process has not been completed yet. We are trying to complete the routing of the customer servers as well.)
5) We consider all of the abuse emails we receive.
6) We have hardened our spam policies and started serious audits in this regard.
7) We do not allow email marketing.
8) We make the necessary system updates for all the servers in our network. We have also started the renewal process of some end-of-life customer servers.
9) We apply the rate limit for sending e-mails on our hosting servers. We started these studies on customer servers as well.
10) We detect the problematic domain names by examining the logs and take the necessary actions. (Changing the password of e-mail accounts, updating e-mail software, updating applications and attachments on customer websites.)

We have not yet completed all of the above-mentioned improvements, but we are working as quickly as possible. My guess is that we will forward cleaner traffic to Microsoft email services in a short time. But as I mentioned above, we are in a difficult situation against our customers now. We request that the blocking applied to our IP blocks be removed if possible. (All our e-mail traffic is currently passing through …

We would be very glad if you could help us with this. We will continue to improve our efforts.

Regards,

Saygilarimla,

….

Kimden:“Hotmail Sender Support” <WINLV.EDFS.WW.00.EN.CVG.BGL.TS.T03.ESC.00.EM@css.one.microsoft.com>
Kime:
Gönderilenler:30 Mayis Cumartesi 2020 15:02:06
Konu:RE: SRX1502004286ID – [EXTERNAL] Re: Reported deliverability problem to Outlook.com SRX1502004286ID

Hello,

We have investigated your deliverability issue regarding IP’s

……… At the current time, these IPs are not eligible for mitigation.

We are concerned with a pattern of irregular mail traffic originating from your IPs. While this could be benign, sudden changes in email sending volume can be the result of a server or network compromise or the result of compromised user accounts.

It takes time to improve IP reputation and careful vigilance of your email systems which includes monitoring the information you can receive from server logs and programs such as JMRP and/or SNDS to help identify potential issues, such as compromised servers or accounts, spikes in sending overall volume etc. There is no silver bullet, unfortunately, to improve or maintain IP reputation.

While we cannot offer mitigation at this time, please note that our technologies designed to prevent unwanted mail are not static and will respond to changes in sending practices over time. In addition to the best practices we have already recommended, here are some specific recommendations for you to consider:

• Review outbound mail logs – It’s recommended that you have network and email admins review server logs for anomalies and verify all of the email sending is intentional. Be aware that not all compromises immediately result in a high volume of mail. Some attacks may be more subtle, and may only periodically send mail from infected mail servers. Therefore, careful log review may be necessary to detect and address potential compromise issues. As a best practice, set up monitoring on outbound sending volume to ensure that sudden, unexpected peaks are quickly identified and reviewed.
• Security review of sending servers – In addition, it’s recommended you ensure all sending servers are up-to-date with the latest security patches, updates, etc. and that security and anti-virus scans are regularly executed against all sending servers.
• Implement Sending Limits – It’s a recommended best practice to enforce sending limits on your domain accounts; this is a simple method to prevent users who may be compromised from sending bulk emails and helps better protect the reputation? of your IPs.

In addition, Microsoft has several programs which can assist you with identifying and monitoring potential issues, such as compromised servers, outdated mailing lists, etc. Joining these programs does not mean you are whitelisted from Outlook.com. Here are some specific recommendations for you to consider:

• Actively monitor your junk mail reports – The free JMRP program (http://mail.live.com/mail/services.aspx) provides reports on junk email reported by Outlook.com customers for your IP addresses. This helpful feedback mechanism allows you to ensure that mails being sent on your IPs are not resulting in negative feedback that could impact your sending IP reputation. Being vigilant about users who mark your e-mail as unwanted (or junk) or the types of messages that are being marked as unwanted (or junk) can help you identify unintended mail traffic, modify future campaigns and keep mailing lists updated with only interested consumers. You can Enroll at

https://postmaster.live.com/snds/JMRP.aspx?wa=wsignin1.0

• Actively Monitor IP Traffic – Consider joining the Smart Network Data Services program (SNDS). This free program provides data about traffic seen originating from your registered IPs, such as mail volume and complaint rates. The data is built from the log files of the inbound mail machines and other servers at Outlook.com and Microsoft and represents factual information about the traffic from your mail servers to Outlook.com users. For more information about this free program refer tohttps://postmaster.live.com/snds/FAQ.aspx. To register, please go tohttp://postmaster.msn.com/snds/.

Sincerely,

S…..

Outlook.com Deliverability Support

Kimden:“WINLV EDFS WW 00 EN MSF RMD TS T01 SPT 00 EM” <WINLV.EDFS.WW.00.EN.MSF.RMD.TS.T01.SPT.00.EM@css.one.microsoft.com>
Kime:
Gönderilenler:30 Mayis Cumartesi 2020 7:13:38
Konu:Reported deliverability problem to Outlook.com SRX1502004286ID

Dear …

We have completed reviewing the IP(s) you submitted. The following table contains the results of our investigation.

Not qualified for mitigation
………….
Our investigation has determined that the above IP(s) do not qualify for mitigation.

Please ensure your emails comply with the Outlook.com policies, practices and guidelines found here:http://mail.live.com/mail/policies.aspx.

To have Deliverability Support investigate further, please reply to this email with a detailed description of the problem you are having, including specific error messages, and an agent will contact you.

Regardless of the deliverability status, Outlook.com recommends that all senders join two free programs that provide visibility into the Outlook.com traffic on your sending IP(s), the sending IP reputation with Outlook.com and the Outlook.com user complaint rates.

Junk Email Reporting program (JMRP) When an Outlook.com user marks an email as “junk”, senders enrolled in this program get a copy of the mail forwarded to the email address of their choice. It allows senders to see which mails are being marked as junk and to identify mail traffic you did not intend to send. To join, please visithttp://support.msn.com/eform.aspx?productKey=edfsjmrpp&page=support_home_options_form_byemail&ct=eformts.

Smart Network Data Services program (SNDS). This program allows you to monitor the ‘health’ and reputation of your registered IPs by providing data about traffic such as mail volume and complaint rates seen originating from your IPs. To register, please visithttp://postmaster.live.com/snds/.

There is no silver bullet to maintaining or improving good IP reputation, but these programs help you proactively manage your email eco-system to help better ensure deliverability to Outlook.com users.

Thank you,

Outlook.com Deliverability Support