Example of Microsoft "Support"

[Jeff G.]

Slightly munged for the web. Spammer sent spam forging a return address through open proxy 87-126-81-31.btc-net.bg [87.126.81.31] to unavailable mailbox jrmagana[at]msn.com. postmaster[at]hotmail.com on bay0-mc8-f10.bay0.hotmail.com bounced the spam message. I got the bounce and sent a SpamCop Report to abuse[at]hotmail.com. bay0-mc9-f12.bay0.hotmail.com sent the Report on to abuse[at]css.one.microsoft.com. postmaster[at]partners.extranet.microsoft.com on ext-imc-01.partners.extranet.microsoft.com bounced the Report because the mailbox for abuse[at]css.one.microsoft.com was full.

Return-Path: <spamcop[at]devnull.spamcop.net>

Delivered-To: spamcop-net-x[at]spamcop.net

Received: (qmail 30164 invoked from network); 8 Dec 2005 23:11:40 -0000

X-spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on blade5

X-spam-Level:

X-spam-Status: hits=-94.9 tests=NO_REAL_NAME,URIBL_JP_SURBL,URIBL_WS_SURBL,

USER_IN_WHITELIST_TO version=3.1.0

Received: from unknown (192.168.1.103)

  by blade5.cesmail.net with QMQP; 8 Dec 2005 23:11:40 -0000

Received: from vmx1.spamcop.net (204.15.82.27)

  by mx53.cesmail.net with SMTP; 8 Dec 2005 23:11:40 -0000

Received: from sc-app3.ironport.com (HELO spamcop.net) (204.15.82.22)

  by vmx1.spamcop.net with SMTP; 08 Dec 2005 15:11:41 -0800

X-SpamCop-Reply-Ids: 1579247783

X-Spamcop-Return-Path: <MAILER-DAEMON>

Received: from vmx1.spamcop.net (vmx1.spamcop.net [204.15.82.27])

by sc-app3.soma.ironport.com (Postfix) with ESMTP id 4832314291

for <1579247783[at]reports.spamcop.net>; Thu,  8 Dec 2005 15:10:36 -0800 (PST)

Received: from mail4.mssupport.microsoft.com (HELO ext-imc-04.partners.extranet.microsoft.com) (131.107.70.12)

  by vmx1.spamcop.net with ESMTP; 08 Dec 2005 15:10:37 -0800

Received: from ext-imc-02.partners.extranet.microsoft.com ([10.251.71.31]) by ext-imc-04.partners.extranet.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830);

  Thu, 8 Dec 2005 15:10:31 -0800

Received: from ext-imc-01.partners.extranet.microsoft.com ([10.251.71.30]) by ext-imc-02.partners.extranet.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830);

  Thu, 8 Dec 2005 15:10:30 -0800

From: postmaster[at]partners.extranet.microsoft.com

To: 1579247783[at]reports.spamcop.net

Date: Thu, 8 Dec 2005 15:10:20 -0800

X-DSNContext: 7ce717b1 - 1194 - 00000002 - 00000000

Message-ID: <T2JveR6IH00032ebe[at]ext-imc-01.partners.extranet.microsoft.com>

Subject: Delivery Status Notification (Failure)

X-OriginalArrivalTime: 08 Dec 2005 23:10:30.0204 (UTC) FILETIME=[954617C0:01C5FC4C]

X-SpamCop-Checked: 192.168.1.103 204.15.82.27 204.15.82.22 204.15.82.27 131.107.70.12 10.251.71.31 10.251.71.30

X-SpamCop-Whitelisted: x

X-Antivirus: AVG for E-mail 7.1.371 [267.13.12/194]

Mime-Version: 1.0

Content-Type: multipart/mixed; boundary="=======AVGMAIL-439902EA42FB======="

--=======AVGMAIL-439902EA42FB=======

Content-Type: multipart/report; report-type=delivery-status; boundary="9B095B5ADSN=_01C5ED84AC4BA312000051FFext?imc?01.partn"

--9B095B5ADSN=_01C5ED84AC4BA312000051FFext?imc?01.partn

Content-Type: text/plain; charset=unicode-1-1-utf-7

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

      abuse[at]css.one.microsoft.com

--9B095B5ADSN=_01C5ED84AC4BA312000051FFext?imc?01.partn

Content-Type: message/delivery-status

Reporting-MTA: dns;ext-imc-01.partners.extranet.microsoft.com

Received-From-MTA: dns;ext-imc-01.partners.extranet.microsoft.com

Arrival-Date: Thu, 8 Dec 2005 05:07:11 -0800

Content-Type: text/plain

Final-Recipient: rfc822;abuse[at]css.one.microsoft.com

Action: failed

Status: 4.2.2

Diagnostic-Code: smtp;452 4.2.2 Mailbox full

--9B095B5ADSN=_01C5ED84AC4BA312000051FFext?imc?01.partn

Content-Type: message/rfc822

X-SCL: 9 93.49%

Received: from ext-imc-01.partners.extranet.microsoft.com ([10.251.71.26]) by ext-imc-01.partners.extranet.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830);

  Thu, 8 Dec 2005 05:07:11 -0800

Received: from mailout1.microsoft.com ([157.54.1.117]) by ext-imc-01.partners.extranet.microsoft.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.1830);

  Thu, 8 Dec 2005 05:05:43 -0800

Received: from igs-hub-01.northamerica.corp.microsoft.com ([157.57.217.10]) by mailout1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830);

  Thu, 8 Dec 2005 05:05:44 -0800

Received: from IGS-IMC-01.northamerica.corp.microsoft.com ([157.57.195.41]) by igs-hub-01.northamerica.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830);

  Thu, 8 Dec 2005 05:05:43 -0800

Received: from bay0-pcs2.bay0.hotmail.com ([65.54.241.240]) by IGS-IMC-01.northamerica.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.2499);

  Thu, 8 Dec 2005 05:05:43 -0800

Received: (from root[at]localhost)

by bay0-pcs2.bay0.hotmail.com (8.12.10/8.12.10) id jB8D5hIW026869

for abuse[at]css.one.microsoft.com; Thu, 8 Dec 2005 05:05:43 -0800 (PST)

To: abuse[at]css.one.microsoft.com

X-Message-Status: n

X-SID-PRA: spam Fighter <1579247783[at]reports.spamcop.net>

X-SID-Result: Pass

X-Message-Info: H83ySVbTRY0lGnrKvuGJgWhW1pJKgb5OvbmeU2D4gTE=

Received: from vmx1.spamcop.net ([204.15.82.27]) by bay0-mc9-f12.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);

  Thu, 8 Dec 2005 05:05:30 -0800

Received: from sc-app4.ironport.com (HELO spamcop.net) (204.15.82.23)

  by vmx1.spamcop.net with SMTP; 08 Dec 2005 05:05:15 -0800

From: "spam Fighter" <1579247783[at]reports.spamcop.net>

Subject: [spamCop (65.54.246.126) id:1579247783]Delivery Status Notification (Failure)

Precedence: list

Message-ID: <rid_1579247783[at]msgid.spamcop.net>

Date: Wed, 7 Dec 2005 23:15:44 -0800

X-SpamCop-sourceip:

X-Mailer: http://www.spamcop.net/ v1.514

X-OriginalArrivalTime: 08 Dec 2005 13:05:30.0081 (UTC) FILETIME=[10B6E510:01C5FBF8]

Return-Path: 1579247783[at]reports.spamcop.net

Content-Type: text/plain

[ SpamCop V1.514 ]

This message is brief for your comfort.  Please use links below for details.

Unsolicited bounce from: 65.54.246.126

[Tracking URL]

65.54.246.126 appears to be sending unsolicited bounces, please see:

http://www.spamcop.net/fom-serve/cache/329.html

[ Offending message ]

Received: (qmail 30436 invoked from network); 8 Dec 2005 07:17:02 -0000

Received: from unknown (HELO pre-smtp05-02.prod.mesa1.secureserver.net) ([64.202.166.15])

          (envelope-sender <>)

          by smtp10-01.prod.mesa1.secureserver.net (qmail-ldap-1.03) with SMTP

          for <x>; 8 Dec 2005 07:17:02 -0000

Received: (qmail 21553 invoked from network); 8 Dec 2005 07:17:02 -0000

Received: from unknown (HELO bay0-omc1-s31.bay0.hotmail.com) ([65.54.246.103])

          (envelope-sender <>)

          by pre-smtp05-02.prod.mesa1.secureserver.net (qmail-ldap-1.03) with SMTP

          for <x>; 8 Dec 2005 07:17:01 -0000

Received: from bay0-mc8-f10.bay0.hotmail.com ([65.54.246.126]) by bay0-omc1-s31.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);

  Wed, 7 Dec 2005 23:15:44 -0800

From: postmaster[at]hotmail.com

To: x

Date: Wed, 7 Dec 2005 19:59:07 -0800

X-DSNContext: 335a7efd - 4464 - 00000001 - 80040546

Message-ID: <q7EDAO0qT0000374f[at]bay0-mc8-f10.bay0.hotmail.com>

Subject: Delivery Status Notification (Failure)

Return-Path: <>

X-OriginalArrivalTime: 08 Dec 2005 07:15:44.0145 (UTC) FILETIME=[341F3010:01C5FBC7]

X-Nonspam: None

X-Antivirus: AVG for E-mail 7.1.371 [267.13.12/193]

Mime-Version: 1.0

Content-Type: multipart/mixed; boundary="=======AVGMAIL-4397DF460AD9======="

--=======AVGMAIL-4397DF460AD9=======

Content-Type: multipart/report; report-type=delivery-status; boundary="9B095B5ADSN=_01C5F87AE612262700004EA4bay0?mc8?f10.bay"

--9B095B5ADSN=_01C5F87AE612262700004EA4bay0?mc8?f10.bay

Content-Type: text/plain; charset=unicode-1-1-utf-7

This is an automatically generated Delivery Status Notification.

Delivery to the following recipients failed.

      jrmagana[at]msn.com

--9B095B5ADSN=_01C5F87AE612262700004EA4bay0?mc8?f10.bay

Content-Type: message/delivery-status

Reporting-MTA: dns;bay0-mc8-f10.bay0.hotmail.com

Received-From-MTA: dns;87-126-81-31.btc-net.bg

Arrival-Date: Wed, 7 Dec 2005 19:59:06 -0800

Content-Type: text/plain

Final-Recipient: rfc822;jrmagana[at]msn.com

Action: failed

Status: 5.5.0

Diagnostic-Code: smtp;550 Requested action not taken: mailbox unavailable (-640593812:1337:0)

--9B095B5ADSN=_01C5F87AE612262700004EA4bay0?mc8?f10.bay

Content-Type: message/rfc822

Received: from 87-126-81-31.btc-net.bg ([87.126.81.31]) by bay0-mc8-f10.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);

  Wed, 7 Dec 2005 19:59:06 -0800

Received: from smtp.secureserver.net (smtp.secureserver.net [64.202.166.12])

by 87-126-81-31.btc-net.bg (8.12.11/8.12.11) with ESMTP id mZTEf4BsHFArSq

for <jrmagana[at]msn.com>; Thu, 8 Dec 2005 06:00:07 -0800

Received: from unknown (dsnat [25.190.70.111])

by smtp.secureserver.net via HTTP

for <jrmagana[at]msn.com>; Thu, 8 Dec 2005 06:00:07 -0800

Date: Thu, 8 Dec 2005 06:00:07 -0800

From: x

Reply-To: x

Message-ID: <090807510786.896947882155[at]x>

To: <jrmagana[at]msn.com>

Subject: Very Young alluring Girls Porn on magnificent Video

MIME-Version: 1.0

Return-Path: x

X-OriginalArrivalTime: 08 Dec 2005 03:59:06.0765 (UTC) FILETIME=[bC55DBD0:01C5FBAB]

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: 7bit

[snip spam body]

--9B095B5ADSN=_01C5F87AE612262700004EA4bay0?mc8?f10.bay--

--=======AVGMAIL-4397DF460AD9=======

Content-Type: text/plain; x-avg=cert; charset=us-ascii

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "AVG certification"

No virus found in this incoming message.

Checked by AVG Free Edition.

Version: 7.1.371 / Virus Database: 267.13.12/193 - Release Date: 12/6/2005

--=======AVGMAIL-4397DF460AD9=======--

--9B095B5ADSN=_01C5ED84AC4BA312000051FFext?imc?01.partn--

--=======AVGMAIL-439902EA42FB=======

Content-Type: text/plain; x-avg=cert; charset=us-ascii

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Content-Description: "AVG certification"

No virus found in this incoming message.

Checked by AVG Free Edition.

Version: 7.1.371 / Virus Database: 267.13.12/194 - Release Date: 12/7/2005

--=======AVGMAIL-439902EA42FB=======--

[bobbear]

It doesn't surprise me. The MSN/Hotmail abuse support system is always the one that drives me potty, whether it's a full mailbox, or the crazy spam filter they had on it recently to the irrational auto-response system that bounces any abuse report for the silliest reasons and now I notice that they are not accepting some spam reports at all on abuse[at]msn.com or abuse[at]hotmail.com, (those addresses are only for, and I quote:

. Child exploitation/pornography threats

. Harassment

. Impersonation of an institution or trademark (like a bank or government agency or charity) also known as Phishing

. Issues relating to account credentials being compromised (hacked)

The 'new', (I've only just noticed it so excuse me if I'm a little behind!), spam reporting addresses are report_spam[at]hotmail.com & report_spam[at]msn.com but as I found when I tried to report an MSN counterfeit goods webspace spammer on http:// spaces.msn.com/members/omershay/ [space munged] it gets bounced with the message Unfortunately, in order to process your request, Hotmail Support needs a valid MSN/Hotmail hosted account. Aaaaaargh.....

It then follows with: We can help you best when you forward the spam/abusive mail as an attachment to us. Now, they don't mean an attachment as I understand it, (i.e. an attachment... ), that will just bounce again - believe me I've tried, how I've tried....), they actually mean the source code should be appended and that just bounces as not containing a valid hosted account.... Oh well, let's try the customer service addresses, (or any of the other half a dozen addresses I've accumulated), and see if I can get a 'full mailbox' message too....

[Jeff G.]

This is their new email response, munged for the web:

Received: from unknown (HELO BAY0-XMR-009.phx.gbl) ([65.54.241.58])

          (envelope-sender <abuse[at]hotmail.com>)

          by [myisp]

with SMTP

          for <[me]>; 17 Dec 2005 04:27:40 -0000

Received: from mail pickup service by BAY0-XMR-009.phx.gbl with

Microsoft SMTPSVC;

  Fri, 16 Dec 2005 20:27:40 -0800

To: [me]

From: MSN Hotmail <abuse[at]hotmail.com>

Subject: [original subject]

Return-path: abuse[at]hotmail.com

References: <[my Message-ID]>

Message-ID: <BAY0-XMR-009g5Xmllg00001eee[at]BAY0-XMR-009.phx.gbl>

X-OriginalArrivalTime: 17 Dec 2005 04:27:40.0002 (UTC)

FILETIME=[3738D420:01C602C2]

Date: 16 Dec 2005 20:27:40 -0800

Mime-Version: 1.0

Content-Transfer-Encoding: 8bit

Content-Type: TEXT/PLAIN; charset=iso-8859-1

Thank you for reporting abuse to the MSN Hotmail Support Team. This is

an auto-generated response to inform you that we have received your

submission. Please note that you will not receive a reply if you respond

directly to this message.

MSN Hotmail takes abusive e-mails very seriously. A Support

Representative will review your report and will take appropriate

actions.

If you are reporting Unsolicited Commercial E-Mail (also known as spam

or Junk E-Mail), please resubmit your report to report_spam[at]hotmail.com

or report_spam[at]msn.com depending on the spammer’s domain. Appropriate

actions will be taken.

Abuse[at]hotmail.com and abuse[at]msn.com do NOT process spam reports. These

accounts only process abusive e-mails in, but not limited, to the

following categories:

• Child exploitation/pornography threats

• Harassment

• Impersonation of an institution or trademark (like a bank or

government agency or charity) also known as Phishing

• Issues relating to account credentials being compromised (hacked)

If you suspect a crime is being committed, report it directly to your

local police authorities.

If you need information about how to configure and take more advantage

of your Hotmail Junk E-Mail Filters, please visit the following website:

http://help.msn.com/help.aspx?mkt=en-us&pr...oc_SetUpJMF.htm

If you need further information about MSN Hotmail’s efforts and

technologies used to fight spam and abusive e-mails please visit:

http://postmaster.msn.com/cgi-bin/dasp/pos...=FightJunkEmail

[bobbear]

Yes, that's the one I got first. Unfortunately their new addresses are not configured to accept MSN webspace abusers, (http:// spaces.msn.com/) and all I've found so far is an abuse reporting webform. Further investigation required.....

[bobbear]

Mmmm.... further investigation for a spaces.msn, (are these becoming the new geocities for spammers??), reporting address throws up what could be the new simplified MSN reporting system....

SPACE.0000.NA.US.EN.SYK.MNL.AU.T01.SPT.00.EM[at]css.one.microsoft.com

Probably not an address I'm supposed to use but at least it got me a quick response to a spaces.msn abuse report......

[Telarin]

When a big mail provider like msn/hotmail refuses to follow the RFCs that they (Microsoft) helped to write, it certainly doesn't leave much hope for the rest of us down the line. Just had a look at rfc-ignorant.com and both msn.com and hotmail.com are listed. Though msn doesn't have a listing for the abuse address, so someone with a "we don't handle spam here" reply from them might want to list them as well, not that they seem to care.

[Snowbat]

ntlworld autoresponder October 2003:

Apologies but due to the sheer volume of mails received daily many of which are duplicated complaints, eg about the same piece of spam mail, we may not respond to you personally.

ntlworld autoresponder March 2004:

Please note that we no longer accept any network abuse reports at this address. Any reports must be submitted by using the following web form: http://www.ntlworld.com/netreport

ntlworld autoresponder June 2004:

We will accept reports made to http://www.ntlworld.com/netreport/ and to abuse[at]ntlworld.com.

I don't know what possessed ntlworld to introduce that policy but I'm guessing they dropped it because the vast majority of us continued to send exclusively to their abuse reporting address. Maybe the same tactic would work for MSN/Hotmail? I know I don't have time to pre-classify abuse reports or do any kind of hoop-jumping for any provider. They can either deal with it at their abuse reporting address or ignore it. MSN/Hotmail annoyed many abuse reporters by autobouncing spam reports due to "spam content" recently and this new policy seems more of the same idiocy.