2 added 186 characters in body
source | link

I do not see any evidence from the e-mail you posted that a viable scam could be operated from the message. However, if you post full details maybe this will change. But based on the screenshot, and the information provided I can't conclude there's malicious intent.

A check of the SPF records for email-2.microsoft.com shows:

v=spf1 include:customers.clickdimensions.com ~all

That means clickdimensions.com is known to handle the e-mail traffic out of Azure, and Microsoft themselves uses them. However, the email was sent from email.clickdimensions.com instead of cusotmers.clickdimensions.com; which may explain why the message was marked as spam. Alternatively it is possible someone else is using ClickDimensions CRM to try to masquerade as microsoft -- but the email lacks evidence saying that.

Because both the reply-to addresses and the from address are @microsoft.com, anyone operating a scam would have to work at Microsoft or have hacked someone with access to that address in order to receive replies. Microsoft commonly uses group emails at microsoft.com for support so this seems pretty normal.

It makes sense that they would want VMs with no load on them, that they are giving you for free as part of MSDN, not to be left on because you logged in to play with it and never logged back to use the VM. They probably have a lot of these "orphan" VMs and these e-mails may make it possible for them to reclaim a lot of CPU and Memory they're giving away for marketing reasons.

InThe question is: Are you an MSDN subscriber who has spun up an Azure instance? Is this e-mail completely out of left field or within your usage pattern?

If you do use Azure and MSDN, in the end this message is more likely than not legitimate, just poorly done by low-level likely outsourced support staff.

I do not see any evidence from the e-mail you posted that a viable scam could be operated from the message. However, if you post full details maybe this will change. But based on the screenshot, and the information provided I can't conclude there's malicious intent.

A check of the SPF records for email-2.microsoft.com shows:

v=spf1 include:customers.clickdimensions.com ~all

That means clickdimensions.com is known to handle the e-mail traffic out of Azure, and Microsoft themselves uses them. However, the email was sent from email.clickdimensions.com instead of cusotmers.clickdimensions.com; which may explain why the message was marked as spam. Alternatively it is possible someone else is using ClickDimensions CRM to try to masquerade as microsoft -- but the email lacks evidence saying that.

Because both the reply-to addresses and the from address are @microsoft.com, anyone operating a scam would have to work at Microsoft or have hacked someone with access to that address in order to receive replies. Microsoft commonly uses group emails at microsoft.com for support so this seems pretty normal.

It makes sense that they would want VMs with no load on them, that they are giving you for free as part of MSDN, not to be left on because you logged in to play with it and never logged back to use the VM. They probably have a lot of these "orphan" VMs and these e-mails may make it possible for them to reclaim a lot of CPU and Memory they're giving away for marketing reasons.

In the end this message is more likely than not legitimate, just poorly done by low-level likely outsourced support staff.

I do not see any evidence from the e-mail you posted that a viable scam could be operated from the message. However, if you post full details maybe this will change. But based on the screenshot, and the information provided I can't conclude there's malicious intent.

A check of the SPF records for email-2.microsoft.com shows:

v=spf1 include:customers.clickdimensions.com ~all

That means clickdimensions.com is known to handle the e-mail traffic out of Azure, and Microsoft themselves uses them. However, the email was sent from email.clickdimensions.com instead of cusotmers.clickdimensions.com; which may explain why the message was marked as spam. Alternatively it is possible someone else is using ClickDimensions CRM to try to masquerade as microsoft -- but the email lacks evidence saying that.

Because both the reply-to addresses and the from address are @microsoft.com, anyone operating a scam would have to work at Microsoft or have hacked someone with access to that address in order to receive replies. Microsoft commonly uses group emails at microsoft.com for support so this seems pretty normal.

It makes sense that they would want VMs with no load on them, that they are giving you for free as part of MSDN, not to be left on because you logged in to play with it and never logged back to use the VM. They probably have a lot of these "orphan" VMs and these e-mails may make it possible for them to reclaim a lot of CPU and Memory they're giving away for marketing reasons.

The question is: Are you an MSDN subscriber who has spun up an Azure instance? Is this e-mail completely out of left field or within your usage pattern?

If you do use Azure and MSDN, in the end this message is more likely than not legitimate, just poorly done by low-level likely outsourced support staff.

1
source | link

I do not see any evidence from the e-mail you posted that a viable scam could be operated from the message. However, if you post full details maybe this will change. But based on the screenshot, and the information provided I can't conclude there's malicious intent.

A check of the SPF records for email-2.microsoft.com shows:

v=spf1 include:customers.clickdimensions.com ~all

That means clickdimensions.com is known to handle the e-mail traffic out of Azure, and Microsoft themselves uses them. However, the email was sent from email.clickdimensions.com instead of cusotmers.clickdimensions.com; which may explain why the message was marked as spam. Alternatively it is possible someone else is using ClickDimensions CRM to try to masquerade as microsoft -- but the email lacks evidence saying that.

Because both the reply-to addresses and the from address are @microsoft.com, anyone operating a scam would have to work at Microsoft or have hacked someone with access to that address in order to receive replies. Microsoft commonly uses group emails at microsoft.com for support so this seems pretty normal.

It makes sense that they would want VMs with no load on them, that they are giving you for free as part of MSDN, not to be left on because you logged in to play with it and never logged back to use the VM. They probably have a lot of these "orphan" VMs and these e-mails may make it possible for them to reclaim a lot of CPU and Memory they're giving away for marketing reasons.

In the end this message is more likely than not legitimate, just poorly done by low-level likely outsourced support staff.