URL filter blocking the domain "atlas-trk.prd.msg.ss-inf.net"
Asked by jeff.schuelein:

As of today our email security application is blocking access to the following domain redirect "atlas-trk.prd.msg.ss-inf.net" as spear-phishing, after clicking on view request from an automated Jira ticket email. Can someone tell me what this URL redirect is for and whether it is safe? Thx


Answers:
author: Andy Heinzer
body: Hi [@jeff.schuelein](/t5/user/viewprofilepage/user-id/5526381)

Sorry for the inconvenience here. Yes I can confirm that this URL is legitimately used by our Cloud messaging services. However it appears that new domain was not yet included into the official domains and IP ranges documentation.

It appears that the feature flag that enabled this change has been rolled back for now (within the last day and it can take some time to take affect in all environments) So perhaps the update to documentation might not be coming so quickly. However my understanding is that this change is being reverted as of now.


author: Christian Sorbello
body: Update:

I raised a support ticket with Atlassian who advised this is an intentional change, although they have not yet updated their IP Addresses page... [IP addresses and domains for Atlassian cloud products \| Atlassian Support.](https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/)

comments: author: Jan Tymi?ski
body: Great.

So Atlassian is cool to go against the grain.

All the security trainings train people not to click strange-looking URLs and Atlassian introduces one as a legitimate URL (when a truly legitimate URL could be used instead) and will start teaching all these people to stop worrying about such URLs.

Atlassian, you can do much better and I expect you revise this approach and improve here.

This way you're contributing to lowering global security in the times where it gets extremely important to do everything to improve it.  
Please take a couple of minutes, meet there internally and discuss this approach and an option to generate genuinely looking urls.

If there's \`customer.atlassian.net\` available for the \`customer\`, everyone at \`customer\` should get URLs starting with \`customer.atlassian.net\` within the spaces of the \`customer.

I hope my point here is clear why it is important to not use urls like \`blah-blahblah.blah-some.random-gibberish.unrelated-to-atlassian.net\`


author: Christian Sorbello
body: Following.  

This also started happening to us today. Emails are being blocked by our filter.  

Can anyone confirm the validity of the domain and what has changed?


author: Steve Smith
body: We have end users also getting this URL being used.

[https://atlas-trk.prd.msg.ss-inf.net/f/a/](https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fatlas-trk.prd.msg.ss-inf.net%2Ff%2Fa%2FVKfU3cePhyVoxK-PBP7CtQ~~%2FAAAAAQA~%2FRgRoV0jCP0RqaHR0cHM6Ly9lbGVuaXVtc2VydmljZXMuYXRsYXNzaWFuLm5ldC9zZXJ2aWNlZGVzay9jdXN0b21lci9wb3J0YWwvMjkvU0QtNDkzND9zZGFfc291cmNlPW5vdGlmaWNhdGlvbi1lbWFpbFcLYXRsYXNzaWFudXNCCmZ0wsN0ZsbYIYpSFGtlbi5sYWlAYWRnbnQuY29tLmF1WAQAAAAA&data=05%7C02%7Csteve.smith%40elenium.com%7C74705a54934d459f8f9d08dc93de0c63%7Cc21c29f9ab4e4245941636e7ce9d70b9%7C0%7C0%7C638547829123177738%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=LkUDReRuj0FTP5sQW%2Bp2Z7qkQQ%2FLwQaFb1MwL03WtWg%3D&reserved=0)

Is this a valid Atlassian url?

comments: author: Raimo Neumann
body: [@Steve Smith](/t5/user/viewprofilepage/user-id/5527157) \& [@Jan Tymi?ski](/t5/user/viewprofilepage/user-id/5572322) , same here!

Years of cyber security awareness training got our employees to finally be more careful with e-mails and an ever rising threat due to conflicts in Ukraine and the Middle-East.

Now they're reporting (supposedly) Atlassian-E-Mails containing URLs using, **<https://atlas-trk.prd.msg.ss-inf.net/f/a>**, which, in every sense of cyber security training success, is correct.

![09.jpg](https://community.atlassian.com/t5/image/serverpage/image-id/343159i0D992DBC631AF56B/image-size/large?v=v2&px=999 "09.jpg")

If I'm reading [@Andy Heinzer](/t5/user/viewprofilepage/user-id/541137)'s answer above correctly, this is a legit domain for Atlassian Cloud Services (such as Confluence). However, it would be great to have that confirmed for this type of e-mail before releasing it to our employees.

Sender-domain is id.atlassian.net.

Thanks heaps in advance!


author: Andy Heinzer
body: Hi [@Raimo Neumann](/t5/user/viewprofilepage/user-id/4378248) I reached out to my internal team about this. They have confirmed that this domain is owned and operated by Atlassian. This new address does not yet appear within the documented list of [IP Address Ranges and Domains for Atlassian Cloud products](https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/), however I have also reached out to my documentation team to update that content.


author: Raimo Neumann
body: Thanks heaps for confirming [@Andy Heinzer](/t5/user/viewprofilepage/user-id/541137)! ??


author: Dave Rosenlund _Trundl_
body: Welcome to the community, [@jeff.schuelein](/t5/user/viewprofilepage/user-id/5526381) ?

I cannot find any information about this happening anywhere or to anyone else. So, I suspect you'll need your email security vendor's help here or the administrator of that system or service to whitelist that address.

However, given the urgency, I will escalate this thread to Atlassian support to see if they can provide helpful guidance.

Good luck,

-dave

comments: author: jeff.schuelein
body: Thanks for the quick reply. I was able to whitelist the domain in order to prevent further issues in our environment. I was mostly curious what it was doing and if this was the new norm when opening Jira ticket links within our emails. Thx


Tags: cloud

jira-service-management

jira-service-management-cloud