Re: [mailop] Strange Behavior from Microsoft IP Address

[Gellner, Oliver via mailop]

On 07.05.2024 at 17:12 Vitali Quiering via mailop wrote:

> We've identified an IP address, notably tied to Microsoft (20.203.218.75), 
> executing thousands of hits on our URLs almost immediately after dispatching 
> a newsletter. However, the peculiar part is the variation in the hash 
> segments they're accessing. The URL queries we've seen look something like 
> https://sub.customerdomain.tld/info/Mjl2Y3N6ej, which, upon decoding, starts 
> off with a familiar segment 29vcsz% but diverges significantly right after.

This is most likely an attempt to use an email server as some sort of web 
scanner to rate URIs in incoming messages. In order to not trigger any actions 
when visiting the websites, they replace identifiers with hashed values, 
encrypt the identifiers with ROT13 or similar stuff.

--
BR Oliver


dmTECH GmbH
Am dm-Platz 1, 76227 Karlsruhe * Postfach 10 02 34, 76232 Karlsruhe
Telefon 0721 5592-2500 Telefax 0721 5592-2777
dmt...@dm.de * www.dmTECH.de
GmbH: Sitz Karlsruhe, Registergericht Mannheim, HRB 104927
Geschäftsführer: Christoph Werner, Martin Dallmeier, Roman Melcher

Datenschutzrechtliche Informationen
Wenn Sie mit uns in Kontakt treten, beispielsweise wenn Sie an unser 
ServiceCenter Fragen haben, bei uns einkaufen oder unser dialogicum in 
Karlsruhe besuchen, mit uns in einer geschäftlichen Verbindung stehen oder sich 
bei uns bewerben, verarbeiten wir personenbezogene Daten. Informationen unter 
anderem zu den konkreten Datenverarbeitungen, Löschfristen, Ihren Rechten sowie 
die Kontaktdaten unserer Datenschutzbeauftragten finden Sie 
hier.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Strange Behavior from Microsoft IP Address

[Mark Milhollan via mailop]

On Tue, 7 May 2024, Vitali Quiering wrote:

We've identified an IP address, notably tied to Microsoft 
(20.203.218.75), executing thousands of hits on our URLs almost 
immediately after dispatching a newsletter. However, the peculiar part 
is the variation in the hash segments they're accessing. The URL 
queries we've seen look something like 
https://sub.customerdomain.tld/info/Mjl2Y3N6ej, which, upon decoding, 
starts off with a familiar segment 29vcsz% but diverges significantly 
right after.


Microsoft performs link scanning.  This seems like they are attempting 
to check for mutated patterns as well, something like John the Ripper.



/mark
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Strange Behavior from Microsoft IP Address

[Atro Tossavainen via mailop]

> To give you a bit of context, we operate as an ESP, facilitating our 
> customers in sending out newsletters.

If you want anybody to have an opinion on this stuff why don't you
identify yourself, the domain names and the IPs involved.

-- 
Atro Tossavainen, Founder, Partner
Koli-Lõks OÜ (reg. no. 12815457, VAT ID EE101811635)
Tallinn, Estonia
tel. +372-5883-4269, https://www.koliloks.eu/
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop