OwlCyberSecurity - MANAGER

Edit File: 1720215714.M131782P3965123.cloudbhc.clouditzone.com,S=21997,W=22585:2,S

MIME-Version: 1.0 Date: Sat, 06 Jul 2024 02:41:52 +0500 From: tauseef@onebox.pk To: Bashir Member <Bashir.Member@newstar-group.co.uk> Cc: Support <Support@pulsarcomputing.com>, abdul.qudoos@taiga-apparel.com, info@blisshostingco.net, atif.khan@taiga-apparel.com, support@cybercraft.biz, sameeragem1@gmail.com Subject: Re: Email bounce Back error In-Reply-To: <LO2P123MB554174AF19F443F548F5E7B8EFDF2@LO2P123MB5541.GBRP123.PROD.OUTLOOK.COM> References: <004e01dac788$fe63bd40$fb2b37c0$@taiga-apparel.com> <667e966980b80_21f3f9d5b475df014926168.sidekiq-frequent-fd-podeucentral1-main4-blue-78fc48f47c-l5bvn@email.freshdesk.com> <93fe238b90e70e9b5dc3d00a551b7742@onebox.pk> <CWLP123MB5603DBA5465919E3A0B361B6A3DF2@CWLP123MB5603.GBRP123.PROD.OUTLOOK.COM> <LO2P123MB554174AF19F443F548F5E7B8EFDF2@LO2P123MB5541.GBRP123.PROD.OUTLOOK.COM> User-Agent: Roundcube Webmail/1.6.0 Message-ID: <35af4989d00b11ab2621bca6b08ba915@onebox.pk> X-Sender: tauseef@onebox.pk Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit AoA / Hi We have allowed on our servers and have also added rule in exchange Admin. If specific emails are blocked. We can troubleshoot. It is requested that we may be allowed to retain access to exchange Admin to track and resolve issues at earliest instead of exchanging emails Tauseef On 2024-07-05 21:18, Bashir Member wrote: > Hi Jon/Tauseef, > > Who has blacklisted below IP addresses? Is it Taiga Service Provider > or Newstar? > > The issues with email is not only faced by Imran but myself too. > > Jon you can understand that no matter which ISP provider we go with > they all are routed through BT. > > Blacklisted & Blocked IPs > > 1. 81.158.44.189 - British Telecom (bt.com) (Permanent) > 2. 51.52.206.193 - Gamma Telecom (gammagroup.co) (Occasional) > > Regards, > > Bashir Member > > T: +44 (0) 1772 693290 Ext: 3003 | E: > bashir.member@newstar-group.co.uk > > A: Caxton House, Caxton Road, Fulwood, Preston. PR2 9ZB > > -------------------------------------------------------------------------------------------------------------------------------------------------------- > > > This email, together with any attachments, is for the exclusive and > confidential use of the addressee(s) and may contain legally > privileged information. Any other distribution, use or reproduction > without the sender's prior consent is unauthorised and strictly > prohibited. If you have received this message in error, please notify > bashir.member@newstar-group.co.uk by email immediately and delete the > message from your computer without making any copies. Please note that > any views or options presented in this email are solely those of the > author and do not necessarily represent the views of Newstar Group > Ltd. > The recipient should check any attachments for the presence of > viruses. Newstar Group Ltd. accepts no liability for any damage caused > by any virus transmitted by this email. E-mail transmission cannot be > guaranteed to be secure or error-free as information could be > intercepted, corrupted, lost, destroyed, arrive late or incomplete, or > contain viruses as a result of the transmission process. Newstar Group > Ltd. therefore does not accept liability for any errors or omissions > in the contents of this message, which arise as a result of e-mail > transmission. > > -------------------------------------------------------------------__ > > fashion ü footprint - Please don't print this email unless absolutely > necessary > > From: Support [mailto:Support@pulsarcomputing.com] > Sent: 05 July 2024 16:57 > To: tauseef@onebox.pk; Bashir Member > <Bashir.Member@newstar-group.co.uk> > Cc: abdul.qudoos@taiga-apparel.com; info@blisshostingco.net; > atif.khan@taiga-apparel.com; support@cybercraft.biz; > sameeragem1@gmail.com > Subject: RE: Email bounce Back error > > Hi Tauseef, > > I hope you’re well. > > Thanks for the detailed response and your teams time on this. I > appreciate a lot of time has been spent on this. > > As far as I am aware Imran does not have any issues emailing other > domains but taking everything into account and based on your > diagnosis, it sounds like the IP address associated with the ISP, in > this case BT has been blacklisted by the service providers on route to > your exchange server and therefore is being rejected before reaching > the destination mailbox. > > I would agree that the best course of action would be to request Imran > to contact his ISP to request a new IP (static) if possible. Whether a > range of IP addresses in BT pool of addresses are affected and in > blacklists, remains to be seen. Failing this, potentially changing ISP > maybe the solution. I don’t believe point 4 for the Office 365 rule > would help as the message is being rejected by your servers and we can > see from our side the email is being sent out through the exchange > server but then bounced back after it has left the O365 exchange > server and we not aware this happening for any other domains other > than taiga-apparel.com. > > @'Bashir Member' do you know if Imran is prominently sending these > from his home address? If so, could he contact his ISP to request a > new static IP address if possible? Unfortunately, we won’t have any > authority to speak to them on his behalf. If not, is changing ISP > (internet service provider) an option? > > Kind regards > > [4] > > Jon Barrow > > Technical Services Director | Pulsar Computing Ltd > > A: Unit D3, Europa Trading Estate > > P: 01204799199 [7] M: 07875123771 [8] > > E: jon@pulsarcomputing.com W: https://www.pulsarcomputing.com [4] > > [9] > > [10] > > This e-mail and any attachment are for the intended recipient(s) > alone. It may contain privileged and confidential information that is > exempt from disclosure under English law. If you are not an intended > recipient, you must not copy, distribute or take any action in > reliance on it. If you have received this e-mail in error, please > notify us immediately. Any views or opinions presented are solely > those of the author and not necessarily those of Pulsar Computing Ltd > or its associated companies. > > Pulsar Computing Ltd will only process personal data within the GDPR > legislation guidelines. For more information please visit > http://pulsarcomputing.com/privacy-policy > > Pulsar Computing Ltd is a limited company registered in England, with > number 03485901. Registered office: Unit D3, Europa Trading Est, > Stoneclough Rd, Radcliffe, Greater Manchester, M26 1GG, England. > > From: tauseef@onebox.pk <tauseef@onebox.pk> > Sent: Friday, July 5, 2024 8:43 AM > To: 'Bashir Member' <Bashir.Member@newstar-group.co.uk> > Cc: abdul.qudoos@taiga-apparel.com; info@blisshostingco.net; > atif.khan@taiga-apparel.com; Support <Support@pulsarcomputing.com>; > support@cybercraft.biz; sameeragem1@gmail.com > Subject: Re: Email bounce Back error > Importance: High > > AoA / Hi All, > > Greetings! > > Through collaboration & active support of Abdul Qadoos from Taiga & > Ghulam Ahmed Mujtaba from OneBox, we've identified the root cause of > the email communication issues impacting MD sahib's email delivery. A > detailed report is attached. > > ISSUE DESCRIPTION > > The client is experiencing email communication issues because one of > their internet connections has blacklisted IP addresses. > Unfortunately, no bypass rules are defined in Office 365 Exchange for > these IPs, resulting in automatic blocking of communication by the > Office 365 email system. Temporarily changing the ISP resolves the > communication issue. Below are the IP details. > > Blacklisted & Blocked IPs > > 1. 81.158.44.189 - British Telecom (bt.com) (Permanent) > 2. 51.52.206.193 - Gamma Telecom (gammagroup.co) (Occasional) > > Whitelisted & Allowed IPs > > 3. 31.94.65.2 - EE Limited (ee.co.uk) (Working) > > The route of the email communication was as follows > > 1> Client Device 2> ISP / Network 3> Office 365 Exchange 4> Newstart > Hosting at OneBox for DNS Records info only 5> routed to Taiga Hosting > at OneBox 6> ISP / Network > routed to MDaemon Software Installed > under Taiga Local Network 7> Client Device. > > Segment 2 & 3 needed diagnoses and proper resolution. > > This issue has been identified from the logs of Office 365 Exchange > Admin. Unfortunately, since the first day, we have been requesting > access to the client device, the network to which it was connected, > and administrative access to Exchange Admin. We had already > highlighted this issue in our verbal, WhatsApp, and email > communications that the issues is not with our hosting services, but > it was not given serious attention by the office 365 Vendor. > > As soon as we got the access, the issue was identified. reference > image is attached. > > RESOLUTION OPTIONS FOR ABOVE ISSUE > > * Change the ISP: Consider switching to a different Internet Service > Provider (ISP) if the current one is causing issues. > * Request ISP Whitelisting: Contact your ISP and ask them to > whitelist the necessary IP addresses. > * Static Whitelisted IPs: If your IPs are dynamic, request the ISP to > provide static whitelisted IPs for consistent access. > > * Office 365 Exchange Admin Rule: >>> Create a rule in Office 365 Exchange Admin to allow the specified > IPs temporarily. >>> Adjust the Spam Confidence Level (SCL) settings accordingly to > manage potential spam. > > ALLIED MATTERS > > OFFICE 365 VENDOR & NEWSTAR ENGAGEMENT > > It is worth mentioning that, as per Microsoft’s practice, the Office > 365 tenant is created under the domain name or client name. > Administrative access is always provided to the authorized email of > the client, allowing them to configure and manage their email service > independently with the features available under their license. > Typically, the vendor is responsible for providing the license only, > unless specialized support is purchased directly from Microsoft. > > We are unaware of the arrangements between Newstar and Office 365 > Vendor for support. Ideally, the Office 365 Vendor team should have > identified this, but I believe their support agreement may not cover > Office 365 administration to this extent. > > We have noticed that there are nearly five licensed emails and over 25 > email accounts based on shared mailboxes. While this approach aims to > save storage and licensing costs, it’s essential to consider the > disadvantages associated with shared mailboxes. Given these drawbacks, > we do not recommend using shared mailboxes to our clients. > > No specific configurations or rules were found in Exchange ID, > Microsoft Entra ID or security and compliance center by the existing > vendor. > > OFFICE 365 VENDOR & OLD HOSTING DNS RECORDS RELATED MATTER > > Office 365 Admin is required to provide and confirm DNS Zone Settings > on the hosting server or cPanel. Although we requested this > information in the email chain, it was not provided, and we were > informed that everything was okay. When we migrated hosting from the > previous vendor using cPanel-to-cPanel migration, the old DNS records > were automatically copied to the new hosting environment which means > that previous hosting also had misconfigured DNS records. > > During our investigation of the issue, we also discovered unnecessary > data in the DNS records. We corrected these records based on the > knowledge base provided by Microsoft, which resolved other issues > faced by Taiga & Newstar. However, the problem with the MD email still > persisted. > > OTHER EFFORTS BY US > > 1. Initially, the Taiga Apparel domain and website were hosted on our > Shared Business VPS with a dedicated IP, in accordance with their > budget. This VPS can accommodate up to five clients if needed. > However, we have now migrated Taiga Apparel to a dedicated VPS. > Additionally, we plan to move NewStar hosting to the same dedicated > VPS, ensuring smoother communication between both domains as they > share the same hosting environment. While this transition has incurred > extra costs, we prioritize maintaining strong and long-term relations > with your group, and thus, we are willing to bear this expense for the > current year. > > 2. We have established three email rules in Office 365 Exchange Admin > Mail Flow. These rules allow domain names and IPs associated with our > hosting servers, as well as known communication patterns, to prevent > legitimate emails from being marked as spam. While further > improvements are necessary, they fall outside the scope of our current > work. Also, we are not authorized for the management of Office 365. > > 3. We diagnosed an issue with Office 365 that fell outside the scope > of our work. > > 4. We promptly provided the fastest response and support within 5 > minutes. Our commitment to 24/7/365 support ensures that our clients > are satisfied with our services. > > It will be pertinent to mention here that While the latest > Technologies are primarily credited to developed countries, > underdeveloped countries are also trying to revive their technological > capabilities. > > Tauseef Ahmed > Chief Operating Officer & > Principal Consultant > > On 2024-06-28 15:54, Pulsar Computing wrote: > >> Hi ​Abdul, >> >> Thank you no problem. >> >> ​Kind regards >> >> Jon Barrow >> Technical Services Director >> Support | Pulsar Computing Ltd >> >> 01204 799 199 [2] >> >> jon@pulsarcomputing.com >> >> www.pulsarcomputing.com [3] [3 [4]] >> >> Unit D3, Europa Trading Estate, Manchester, M26 1GG >> >>> On Fri, 28 Jun at 10:35 AM , Abdul Qudoos [MIS] >>> <abdul.qudoos@taiga-apparel.com> wrote: >>> >>> Dear Pulsar Team, >>> >>> Indeed, on July 27, 2024, certain SPF records changed; it took a >>> day >>> for the updates to take effect. >>> >>> Please find the image of the rules we created on the Office 365 >>> panel. >>> >>> Best Regards, >>> >>> Abdul Qudoos >>> >>> Executive - IT - Networks >>> >>> TAIGA APPAREL (PVT.) LTD, (The First LEED Platinum Certified >>> Garment Factory in Pakistan) >>> >>> ADD: 22 KM FEROZPUR ROAD, 4 KM OFF ROHI DRAIN | LAHORE – 54000, >>> PAKISTAN >>> >>> TEL: +92-42-35260391-6 | MOB: +92-317-450-105-8| EMAIL: >>> abdul.qudoos@taiga-apparel.com | WEBSITE: www.taiga-apparel.com >>> [1] [1 [2]] >>> >>> This email, together with any attachments, is for the exclusive >>> and >>> confidential use of the addressee(s) and may contain legally >>> privileged information. Any other distribution, use or >>> reproduction >>> without the sender's prior consent is unauthorised and strictly >>> prohibited. If you have received this message in error, please >>> notify it@taiga-apparel.com by email immediately and delete the >>> message from your computer without making any copies. Please note >>> that any views or options presented in this email are solely those >>> of the author and do not necessarily represent the views of Taiga >>> Apparel (Pvt) Limited. >>> The recipient should check any attachments for the presence of >>> viruses. Taiga Apparel (Pvt) Ltd. accepts no liability for any >>> damage caused by any virus transmitted by this email. E-mail >>> transmission cannot be guaranteed to be secure or error-free as >>> information could be intercepted, corrupted, lost, destroyed, >>> arrive >>> late or incomplete, or contain viruses as a result of the >>> transmission process. Taiga Apparel (Pvt) Limited, therefore does >>> not accept liability for any errors or omissions in the contents >>> of >>> this message, which arise as a result of e-mail transmission. >>> >>> Taiga Apparel (Pvt) Limited accepts no liability for the content >>> of >>> this email, or for the consequences of any actions taken on the >>> basis of the information provided, unless that information is >>> subsequently confirmed on official document of Taiga Apparel (Pvt) >>> Limited. >> >> > -------------------------------------------------------------------__ >> >> >>> fashion ü footprint - Please don't print this email unless >>> absolutely necessary >>> >>> From: Pulsar Computing (support@pulsarcomputing.com) >>> <support@pulsarcomputing.com> >>> Sent: Friday, June 28, 2024 1:51 PM >>> To: abdul.qudoos@taiga-apparel.com >>> Cc: bashir.member@newstar-group.co.uk; info@blisshostingco.net; >>> atif.khan@taiga-apparel.com; tauseef@onebox.pk >>> Subject: Re: Email bounce Back error >>> >>> Hi, >>> >>> I noticed the other day the SPF record has changed slightly for >>> newstar, it's throwing up a format issue for the SPF record. Has >>> this been changed recently by your team as it was showing correct >>> the other day? >>> >>> Thanks for the login's I will retain the added records but I tweak >>> the formatting of this today. >>> >>> Did you manage to sort the exhange rules? >>> >>> KInd regards >>> >>> Jon Barrow >>> >>> Technical Services Director >>> >>> Support | Pulsar Computing Ltd >>> >>> 01204 799 199 [2] >>> >>> jon@pulsarcomputing.com >>> >>> www.pulsarcomputing.com [3] [3 [4]] >>> >>> Unit D3, Europa Trading Estate, Manchester, M26 1GG >>> >>> On Thu, 27 Jun at 6:04 PM , Abdul Qudoos [MIS] >>> <abdul.qudoos@taiga-apparel.com> wrote: >>> >>> Dear Bashir Sb, >>> >>> Please see below email from ONEBOX, >>> >>> “AoA >>> >>> Dear Abdul Qadoos Sb >>> >>> Namecheap is the domain name registration and renewal service and >>> it's our master account where all of our client domains are >>> renewed >>> and managed for nameservers. The current issue has nothing to do >>> with Namecheap. The website and emails services are not hosted on >>> Namecheap. >>> >>> The domain nameservers point to our hosting servers where the >>> website is hosted. cPanel is already provided to you. Its domain >>> zone contain all the information regarding MX records, A records, >>> SPIF records, DKIM records and reverse zone. >>> >>> Link: http://newstar-group.co.uk/cpanel [5] >>> >>> User: newstargroup >>> >>> Password : e3w~A~NWNnn% >>> >>> Please take pre and post pictures for any changes you made so that >>> we can be confirm about the configuration. >>> >>> Tauseef Ahmed” >>> >>> Best Regards, >>> >>> Abdul Qudoos >>> >>> Executive - IT - Networks >>> >>> TAIGA APPAREL (PVT.) LTD, (The First LEED Platinum Certified >>> Garment Factory in Pakistan) >>> >>> ADD: 22 KM FEROZPUR ROAD, 4 KM OFF ROHI DRAIN | LAHORE – 54000, >>> PAKISTAN >>> >>> TEL: +92-42-35260391-6 | MOB: +92-317-450-105-8| EMAIL: >>> abdul.qudoos@taiga-apparel.com | WEBSITE: www.taiga-apparel.com >>> [1] [1 [2]] >>> >>> This email, together with any attachments, is for the exclusive >>> and >>> confidential use of the addressee(s) and may contain legally >>> privileged information. Any other distribution, use or >>> reproduction >>> without the sender's prior consent is unauthorised and strictly >>> prohibited. If you have received this message in error, please >>> notify it@taiga-apparel.com by email immediately and delete the >>> message from your computer without making any copies. Please note >>> that any views or options presented in this email are solely those >>> of the author and do not necessarily represent the views of Taiga >>> Apparel (Pvt) Limited. >>> The recipient should check any attachments for the presence of >>> viruses. Taiga Apparel (Pvt) Ltd. accepts no liability for any >>> damage caused by any virus transmitted by this email. E-mail >>> transmission cannot be guaranteed to be secure or error-free as >>> information could be intercepted, corrupted, lost, destroyed, >>> arrive >>> late or incomplete, or contain viruses as a result of the >>> transmission process. Taiga Apparel (Pvt) Limited, therefore does >>> not accept liability for any errors or omissions in the contents >>> of >>> this message, which arise as a result of e-mail transmission. >>> >>> Taiga Apparel (Pvt) Limited accepts no liability for the content >>> of >>> this email, or for the consequences of any actions taken on the >>> basis of the information provided, unless that information is >>> subsequently confirmed on official document of Taiga Apparel (Pvt) >>> Limited. >>> >>> >> ------------------------------------------------------------------- >>> >>> fashion ü footprint - Please don't print this email unless >>> absolutely necessary >>> >>> From: Bashir Member (Bashir.Member@newstar-group.co.uk) >>> <Bashir.Member@newstar-group.co.uk> >>> Sent: Thursday, June 27, 2024 9:28 PM >>> To: Pulsar Computing <support@pulsarcomputing.com> >>> Cc: abdul.qudoos@taiga-apparel.com; Info@blisshostingco.net; >>> atif.khan@taiga-apparel.com; tauseef@onebox.pk >>> Subject: Re: Email bounce Back error >>> >>> Hi Abdul, >>> >>> Please provide login details of namecheap.com where Newstar domain >>> is hosted. Thanks >>> >>> Sent from my iPhone >>> >>> On 27 Jun 2024, at 16:54, Pulsar Computing >>> <support@pulsarcomputing.com> wrote: >>> >>> Hi Abdul, >>> >>> Please see the details below; >>> >>> temp@newstar-group.co.uk >>> >>> Bah85919 >>> >>> Please let me know once complete so we can deactivate. >>> >>> Jon Barrow >>> >>> Technical Services Director >>> >>> Support | Pulsar Computing Ltd >>> >>> 01204 799 199 [2] >>> >>> jon@pulsarcomputing.com >>> >>> www.pulsarcomputing.com [3] [3 [4]] >>> >>> Unit D3, Europa Trading Estate, Manchester, M26 1GG >>> >>> 18050:2238509 >> >> 18050:2238509 >> >> 18050:2238509 >> >> Links: >> ------ >> [1] http://www.taiga-apparel.com/ [2] >> [2] tel:01204%20799%20199 [6] >> [3] https://www.pulsarcomputing.com/ [4] > > > Links: > ------ > [1] http://www.taiga-apparel.com > [2] http://www.taiga-apparel.com/ > [3] http://www.pulsarcomputing.com > [4] https://www.pulsarcomputing.com/ > [5] http://newstar-group.co.uk/cpanel > [6] tel:01204%20799%20199 > [7] tel:01204799199 > [8] tel:07875123771 > [9] https://www.facebook.com/PulsarComputing > [10] https://uk.linkedin.com/company/pulsar-computing