Scoutinternal

IP Whitelist Outreach and Chinese-Language Spam Ticket Handling

IP Whitelist Outreach and Chinese-Language Spam Ticket Handling

Problem

This cluster covers two distinct categories of tickets that were grouped together: (1) bulk "IP Whitelist Outreach" cases created internally by BitGo (SF#00051037–SF#00051071 series) with no customer-reported problem content, and (2) a large volume of Chinese-language spam/junk submissions sent to support@bitgo.com containing randomized alphanumeric strings, QQ group numbers (e.g., qun715317219, qun872633380, qun872614387), and solicitation text. Neither category represents a genuine customer support issue. The spam tickets were generated in rapid bursts, often dozens within minutes, and required bulk merging and closure.

Diagnostics

  • Identify spam pattern: Check whether the ticket subject and body contain randomized alphanumeric prefixes followed by Chinese characters and a qun + numeric string (e.g., qun715317219, qun872633380). These are QQ group solicitation spam.
  • Check sender email: Many of these tickets have no valid sender email address. Agent notes in tickets confirm "no sender email" or "no sender" as a diagnostic finding.
  • Identify IP Whitelist Outreach tickets: Look for tickets with the exact subject line "IP Whitelist Outreach" and case numbers in the SF#00051037–SF#00051071 range. These contain no customer-reported problem, no diagnostic thread content, and no resolution details — they appear to be internally generated bulk outreach cases.
  • Check for auto-reply artifacts: Some spam tickets triggered QQ Mail auto-replies (e.g., "这是来自QQ邮箱的假期自动回复邮件" — "This is an automatic vacation reply from QQ Mail"), which created additional noise tickets.
  • Verify no legitimate customer content exists: Before closing, confirm the ticket body does not contain any genuine BitGo customer inquiry buried among the spam text.

Resolution

Scenario: outreach-ip-whitelist-cklwmfqun715317219#chinese-spam-tickets

Trigger: Ticket subject and body contain randomized alphanumeric strings, Chinese characters with solicitation text, and QQ group numbers (pattern: qun followed by digits).

Signals: qun715317219, qun872633380, qun872614387, qun879193418, qun825455517, qun772034651, qun745674017, qun371105376, qun532513113, 帮我打, 每天300, 每小时80, 给你三佰, Chinese spam, no sender email, no sender, QQ邮箱

Steps:

  1. Confirm the ticket matches the spam pattern: randomized alphanumeric prefix + Chinese solicitation text + qun + numeric ID.
  2. Verify no legitimate customer inquiry is embedded in the ticket or its thread.
  3. If the ticket has no sender email, note "no sender" in the resolution.
  4. Merge duplicate spam tickets from the same burst into a single parent case. Historical examples show agents merged dozens of cases into a single parent (e.g., cases 00283720–00283762 were all merged into SF#00283744).
  5. Close the merged/parent ticket as spam. No customer response is needed.
  6. If an agent already sent a response requesting clarification before identifying the ticket as spam, no follow-up action is required — the sender address is typically invalid or unmonitored.

Notes: These spam waves arrive in rapid bursts (dozens of tickets within 1–2 hours). The QQ group numbers change across waves but the message structure remains consistent. Auto-reply artifacts from QQ Mail ("这是来自QQ邮箱的假期自动回复邮件") may generate additional tickets that should also be closed as spam.

Created at: Mon, Jul 03, 2023 at 5:45 AM PDT — "no sender email" (ticket #34682)

Created at: Wed, Jul 05, 2023 at 5:31 AM PDT — "no sender" (ticket #39997)

"Hi, Thank you for reaching out to BitGo Support. We are glad to assist you further, however, we require more information from you to assist you further. Could you please elaborate on the issue you are experiencing?" (ticket #34664)

Scenario: outreach-ip-whitelist-cklwmfqun715317219#ip-whitelist-outreach-bulk

Trigger: Ticket subject is exactly "IP Whitelist Outreach" with sequential Salesforce case numbers (SF#00051037 through SF#00051071 range) and no customer-reported problem content.

Signals: IP Whitelist Outreach, SF00051037, SF00051038, SF00051039, SF00051040, ip whitelist, outreach, bulk cases, no problem description

Steps:

  1. Recognize these as internally generated bulk outreach cases. The tickets contain no customer-reported issue, no diagnostic content, and no resolution beyond the creation timestamp.
  2. Do not attempt to diagnose or resolve — there is no customer problem to address.
  3. If a customer replies to one of these outreach cases with a question or issue, treat the reply as a new support request and handle accordingly based on the content of their reply.
  4. If no customer reply was received, the ticket can remain in its current closed/resolved state. No further action is needed.

Notes: The source tickets provide no detail about the content or purpose of the IP Whitelist Outreach campaign. If an agent needs context on what was communicated to customers in these outreach emails, escalate to the team or manager who initiated the campaign. The tickets themselves contain only creation timestamps with no substantive body or resolution.

Related

  • policy-structure — IP whitelisting is a wallet policy feature; customers responding to outreach may have questions about whitelist configuration.
  • basics-of-a-policy-and-pending-approvals — Whitelist changes generate pending approvals; relevant if customers reply to outreach with policy change requests.
  • none identified for the spam scenario — these are not related to any BitGo product functionality.