Delivery has failed to these recipients or groups - Microsoft Community

good afternoon, 

one of users receives following message upon sending email.

i have been spamhouse check our domain , unlisted. 

we using office 365 business premium

please advice, 

regards, 

delivery has failed these recipients or groups:

l****** d***** (d********@ca******.com)
your message wasn't delivered because recipient's email provider rejected it.

diagnostic information administrators:

generating server: vi1pr10mb1790.eurprd10.prod.outlook.com

d********@ca******.com
remote server returned '550 5.7.501 service unavailable, client host blocked using spamhaus. request removal list see http://www.spamhaus.org/lookup.lasso (as16042849)'

original message headers:

received: vi1pr10mb1789.eurprd10.prod.outlook.com (10.165.194.154) by

vi1pr10mb1790.eurprd10.prod.outlook.com (10.165.194.155) microsoft smtp

server (version=tls1_2, cipher=tls_ecdhe_rsa_with_aes_256_cbc_sha384_p256) id

15.20.77.7; tue, 26 sep 2017 12:55:11 +0000

received: vi1pr10mb1789.eurprd10.prod.outlook.com

([fe80::448b:91eb:db06:9c82]) vi1pr10mb1789.eurprd10.prod.outlook.com

([fe80::448b:91eb:db06:9c82%13]) mapi id 15.20.0077.011; tue, 26 sep

2017 12:55:11 +0000

content-type: application/ms-tnef; name="winmail.dat"

content-transfer-encoding: binary

from: s <
s*******@h******se.com
>

to: l <d********@ca******.com>

subject: fw: test email

thread-topic: test email

thread-index: aqhtnsy/hjissuihzuowy4ygyeqwr6lhhvl6gaaa16e=

date: tue, 26 sep 2017 12:55:10 +0000

message-id: <*** email address removed privacy ***>

references: <*** email address removed privacy ***>,<*** email address removed privacy ***>

in-reply-to: <*** email address removed privacy ***>

accept-language: en-us

content-language: en-us

x-ms-has-attach: yes

x-ms-tnef-correlator: <*** email address removed privacy ***>

mime-version: 1.0

x-originating-ip: [41.223.119.40]

x-ms-publictraffictype: email

x-microsoft-exchange-diagnostics: 1;vi1pr10mb1789;35:+leozm1ghqwjaf+2ntqxzmer8cxo4r1lzruwz8kj19tz5hoj8g1avb2bwckpqqwvtzw1onqtmocswzjzrn54wg==

x-ms-exchange-antispam-srfa-diagnostics: ssos;

return-path: s*******@h******se.com

x-ms-office365-filtering-correlation-id: 2a85dba0-a10b-49e1-dfb4-08d504ddd29a

x-microsoft-antispam:

uriscan:;bcl:0;pcl:0;ruleid:(22001)(2017030254152)(2017082002075)(2017052603199)(49563074)(201703131423075)(201702281549075);srvr:vi1pr10mb1790;

x-microsoft-exchange-diagnostics:

1;vi1pr10mb1790;3:crochqvlbu4otkgma2y+/ymdo9vtbaawq4b5o7g60rg8q22wjh6mcnflorulkqe41vnma7f/kjsakhzcqjwzx++k3htkdbjggq8qaew+bf0o8yqhuqds3lyohc51neidqpr0nzyawzxmfsx4i4v/dxssrdw3xwe84mxwydgrt3nliddpvjezl7+egypfsrl2rmjrnpf1ci0cra2e1jkwfu6meqhhfzrltjev6rxz/lkjvorrsrqmoq6xuw2of8ue;25:fl51yi09b06mk4srqnpyo0bp7agoeuxrwsf55j4+q/ttkteult/j/b6i/yl2wvbsk1ai/erzcamhqvmv+pzqftbemfn7vxcc2e4ugocm94yn5o6wx2bvllyt9bujkuuw8ohnuf7ingmhir3vzk6asewqs4gdlrqu3ygyyglbepbtx+ruh4vlxjrowxwkx1lgxc+ndk1lrli+1xb0owxjxre+jbl8+phug5rn1owtl8fv//b+jglbk2tvqhy/yl8arp4hivmgogqgzojpvcngygmlceqcb7w5mgwxkvafbojfyt7qlofdrbpok6ijux+ooisxivsxcfvhn1uyqkfe/q==;31:0yxjtqbjgfq6jauc0xkw28x2hxvq80espvyheon3my4/tdwp5hyvgkcnyhrvjzi6yaepab9/k7w0ek4vvihtq6tk7wy+l+bl0wxoeovhgo9vtvy5mozamebcljp7poouqfvm1hjdrq7k+igjjulqbs22fzq3+/bsa5xsuo4n3nkh/pwa53/6hiy9cq/1xqhzwd64iihogd+5ml5zbt6vesp2b/mo/sb/rn11p2ejthq=

x-ms-traffictypediagnostic: vi1pr10mb1790:

x-exchange-antispam-report-test: uriscan:(158342451672863)(189930954265078);

x-microsoft-antispam-prvs:

        <*** email address removed privacy ***>

x-ms-exchange-outboundspamhaus: true

x-exchange-antispam-report-cfa-test:

bcl:0;pcl:0;ruleid:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(102415395)(6040450)(2401047)(5005006)(8121501046)(93006095)(93001095)(10201501046)(100000703101)(100105400095)(3002001)(6041248)(20161123560025)(6059035)(20161123555025)(16040078)(20161123558100)(20161123562025)(201703131423075)(201703011903075)(201703061421075)(201703151056150)(201703061814153)(20161123564025)(2016111802025)(16043105)(16042156)(6072148)(6043046)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);srvr:vi1pr10mb1790;

x-microsoft-exchange-diagnostics:

1;vi1pr10mb1790;4:acb8uze+1x2mxj5id+2rbni0gds/rbncycbxxfzdoiv62smoor0rsfwkpm3w2lcv141iquwjlo5qzbhjj+eooqbmfxmccaptnm66ncskqdsx/yiptknmyb8dzr/0o1tlgjer324q8xru7ivnef0j1i25+366fjwm0iotz7zx269bsdt9racvyy8qywmt7txrzpfccw0hjio5nv0sg5d2o1lmdf4bcfkr9kkfhgq28f4jlyxawjtpo17qv13fv0zzkamiz+jus6nvm6ux+f7hs7jevqsrwgkyvmj+5lqbw3+emkzsfwd/edcwz42s5vbzmm9vdtixeotqwviz6cqjkw==;23:tbbqw2+dmqfjwnrjbtn3snea9xewbxpi2yuwrwv2eqizw5rswebdzbp/h1mwf3togj6oiavcfmsrfiapttnpawjummvjgnobr1ojktxmexyrngly1gfme+ysv4lucu+yvohqlzktmilbdne+njghi1zfo+pgjbcn6aadq+bhtxfhug6akwji/wokabgm3hi81rduijwop0rhg3latkycrtbhuwep/txhgek9k7rxc/4=;6:c4m2+bqo9fxzbisf3dqeraoz5al4ham5ydlcieyjetgwuywtsp11a50liygkqehf/msdncw46s9ch/dpigeak4at6vjldlrncxqgi4kdwwmssgfkaweu3di+2d2oniv+l7vvpx4ecog0nenaryjw3jpshx1auggd0p0pcgbbv0tpdt5keovx1b0udmkvilevuga2dsinx0tiescygdloabwc6p2p7xyqygay6lqpufroftp31a6ajxnfbcv+xjgkrs0cyujwikc/dofbfpmjtvijao8j9hvve2o0ej3jnwjvc/1ele64bjt9ghygsbcwaqm7muc+jxlj5wlgjao44a==

x-forefront-prvs: 0442e569bc

 

ok, 

i have found solution, going spamhouse website, using ip address return blocked ip (you can find ip under "x-originating-ip: [41.223.119.40]" in error message)

i followed instruction remove database. 

the user using 3g dongle shared ip, therefore in network must have been infected botnet.

Outlook.com / Email / Sending, receiving, and reading email