40.83.112.59 - "Using rdns to route to correct Microsoft department" but reports go to spammer

[Snowbat]

40.74.0.0 - 40.125.127.255 is Microsoft but SpamCop reports 40.83.112.59 directly to the spammer. I've seen similar misreporting for other Microsoft-hosted spammers.

 

https://www.spamcop.net/sc?id=z6710180092z696fdaf09331d4788f922556d0e571fcz

Routing details for 40.83.112.59
[refresh/show] Cached whois for 40.83.112.59 : abuse@microsoft.com
Using best contacts abuse@microsoft.com
Using rdns to route to correct Microsoft department
host 40.83.112.59 = descontosapp27.confiraseusdescontosepontos.com. (cached)
abuse net confiraseusdescontosepontos.com = postmaster@confiraseusdescontosepontos.com

 

If reported today, reports would be sent to:

Re: 40.83.112.59 (Administrator of network where email originates)

postmaster@confiraseusdescontosepontos.com

[gnarlymarley]

On 4/23/2021 at 7:41 AM, Snowbat said:

40.74.0.0 - 40.125.127.255 is Microsoft but SpamCop reports 40.83.112.59 directly to the spammer. I've seen similar misreporting for other Microsoft-hosted spammers.

 

Even though it appears it wants to send directly to the spammer, I don't see the domain and being valid, so this should bounce.

C:\>nslookup confiraseusdescontosepontos.com
Server:         192.168.1.1
Address:        192.168.1.1#53

** server can't find confiraseusdescontosepontos.com: NXDOMAIN


C:\>