There's no real way to prevent this behavior as long as you send out loads of individual emails with links back to a server you run on premises. Any self-respecting mail gateway, is going to scan all URLs contained in the messages and review the returned content, malicious or otherwise. You can either omit the links from your UCE, or host your content elsewhere (or at least the content related to the mass marketing emails).
Does anyone know what they're looking for? How we should respond to the requests? Any documentation I can read?
As for the "ZW1haWwtdW" URL, it is anybody's guess. Anything short of a direct response from Microsoft, Proofpoint (who I believe is behind the scenes with EOP/ATP), and other mail gateway/security vendors is going to be an educated guess. Vendors of these services are usually (and rightfully) tight-lipped about their exact practices they use when checking links and why each step is performed. Simply put, you are not going to get a handbook from Microsoft of how to properly respond to their EOP-initiated scans.
One can assume that this is a check for either a particular threat or to perform an analysis on what happens when a (supposed) bad URL is visited. That is, does this website return a 404 (which one would expect), or does it redirect to a generic landing page which may be suspect. Using the same pattern does seem a little odd, though, you would think that after a while a bad actor would catch onto this and could modify the site behavior to address this.
The company wants to be a good net 'citizen' and accommodate anything that assists in enhancing 'trust' regarding our email marketing so dropping the traffic is not an option.
To these ends, I would suggest leveraging a good third-party mailing service - and use a subdomain of your normal domain for these campaigns. Running marketing campaigns from your production email infrastructure is a good way to end up on some blacklists, interrupt your normal mail traffic, and (actually) probably doesn't provide you the kind of insight into campaign effectiveness as you could see from a third-party.
Thoughts?
If some mail-related scanning is toppling your web servers, its probably fair to say that its not a great experience for your customers (if they opted to check out your content), so that's probably not giving them a good impression either (on top of the fact that they just received an unsolicited email).
I would suggest using a third-party marketing service to handle your bulk commercial emails. I would also suggest looking at some kind of elastic web hosting service to handle your web traffic (or at least the web traffic related to the content you are serving with your marketing email). These are both relatively common practices.
