Lottery Scammers Still Celebrating New Year
[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
VERY IMPORTANT INFORMATION, READ THIS FIRST: The example and associated information published on this page are subject to the SHPAMEE Terms Of Use. Please familiarise yourself with these terms before viewing or using any information on this page.
Header:
From - Thu Apr 8 19:48:25 2010
X-Account-Key: account8
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x
X-YahooFilteredBulk: 64.26.60.144
X-YMailISG:
hWmGROsWLDsuAaW3wzYKdOUfovRS5VKYHqOYHSBaHNdBSC59B5v_RFkZWUOgYdOIHtKDO0rH1c8v_2XszLJkepLlXlnY...
1DVSacVaTFDBascvrGCb8O3VbnKc2vlCEYohwOXTa3CDr3IIO3WnlpWMWASTRzyU67.Tx2GAq24LHb18Ul0YCOEAtKzQ...
iqM56SzcsqMIXzr0bly2wSPBvNc2JepBosYL5toEsCxn0LMrgwLykNqRGS9oWjve5nVZbm5m.yIMpnSPrPmdnIsUE0hz...
u8SSRJGIw3m8O3BAQKYCVxI7z5kmm4TNdMhaAieGXUk._rrLFFydM0B0qciWpSW2FvTR1.B3UUpeLUkWoXpWPK2wvKEm...
EPJEYwfDrTQRE19X09DPjUvyT1ZgVZKxmvYlB2xA2nsGvl7MXKq1RINSOph5nvroxByDFBkqO3tvupl0CpGSixFcGjjh...
17v0KfYqPO5601mBKsx10Qk1UI58O6cRKqkpNgQT567rMoWvRpiMGtQfG50jzUj_zXkyTPRXaS0q6hgFYh0ioDq6RvxE...
WgYMhoctlVGuMxqBzuPQIHkFzNV.bR8ZO93m5TtesrXISRacqQ6dg47idkqdpE6572KsOLynkJCvQ29xZuOhZ5NKiU_5
X-Originating-IP: [64.26.60.144]
Authentication-Results: mta137.mail.ukl.yahoo.com from=; domainkeys=neutral (no sig); from=ukelizabeth.com;
dkim=neutral (no sig)
Received: from 64.26.60.144 (EHLO smtpauth00.csee.onr.siteprotect.com) (64.26.60.144)
by mta137.mail.ukl.yahoo.com with SMTP; Thu, 08 Apr 2010 09:14:06 +0000
Received: from User (unknown [75.87.220.151])
(Authenticated sender: elizabeth1@qwestoffice.net)
by smtpauth00.csee.onr.siteprotect.com (Postfix) with ESMTP id B3F6C758238;
Thu, 8 Apr 2010 03:59:29 -0500 (CDT)
Reply-To: <m.softcorporation.inc@live.co.uk>
From: "MICROSOFT CORPORATION INC"<andre@ukelizabeth.com>
Subject: Congratulation On Your E-mail Success
Date: Mon, 8 Feb 2010 10:10:26 -0800
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <x@smtpauth00.csee.onr.siteprotect.com>
To: undisclosed-recipients:;
X-Account-Key: account8
X-UIDL: x
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
X-Apparently-To: x
X-YahooFilteredBulk: 64.26.60.144
X-YMailISG:
hWmGROsWLDsuAaW3wzYKdOUfovRS5VKYHqOYHSBaHNdBSC59B5v_RFkZWUOgYdOIHtKDO0rH1c8v_2XszLJkepLlXlnY...
1DVSacVaTFDBascvrGCb8O3VbnKc2vlCEYohwOXTa3CDr3IIO3WnlpWMWASTRzyU67.Tx2GAq24LHb18Ul0YCOEAtKzQ...
iqM56SzcsqMIXzr0bly2wSPBvNc2JepBosYL5toEsCxn0LMrgwLykNqRGS9oWjve5nVZbm5m.yIMpnSPrPmdnIsUE0hz...
u8SSRJGIw3m8O3BAQKYCVxI7z5kmm4TNdMhaAieGXUk._rrLFFydM0B0qciWpSW2FvTR1.B3UUpeLUkWoXpWPK2wvKEm...
EPJEYwfDrTQRE19X09DPjUvyT1ZgVZKxmvYlB2xA2nsGvl7MXKq1RINSOph5nvroxByDFBkqO3tvupl0CpGSixFcGjjh...
17v0KfYqPO5601mBKsx10Qk1UI58O6cRKqkpNgQT567rMoWvRpiMGtQfG50jzUj_zXkyTPRXaS0q6hgFYh0ioDq6RvxE...
WgYMhoctlVGuMxqBzuPQIHkFzNV.bR8ZO93m5TtesrXISRacqQ6dg47idkqdpE6572KsOLynkJCvQ29xZuOhZ5NKiU_5
X-Originating-IP: [64.26.60.144]
Authentication-Results: mta137.mail.ukl.yahoo.com from=; domainkeys=neutral (no sig); from=ukelizabeth.com;
dkim=neutral (no sig)
Received: from 64.26.60.144 (EHLO smtpauth00.csee.onr.siteprotect.com) (64.26.60.144)
by mta137.mail.ukl.yahoo.com with SMTP; Thu, 08 Apr 2010 09:14:06 +0000
Received: from User (unknown [75.87.220.151])
(Authenticated sender: elizabeth1@qwestoffice.net)
by smtpauth00.csee.onr.siteprotect.com (Postfix) with ESMTP id B3F6C758238;
Thu, 8 Apr 2010 03:59:29 -0500 (CDT)
Reply-To: <m.softcorporation.inc@live.co.uk>
From: "MICROSOFT CORPORATION INC"<andre@ukelizabeth.com>
Subject: Congratulation On Your E-mail Success
Date: Mon, 8 Feb 2010 10:10:26 -0800
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <x@smtpauth00.csee.onr.siteprotect.com>
To: undisclosed-recipients:;
Body:
MICROSOFT HOUSE PRESCOT, LONDON E1 8RP.
UNITED KINGDOM.
ELECTRONIC MAIL AWARD PROMOTION.
The Microsoft Mega Jackpot Lottery, United Kingdom wishes to inform you that the results of the New Year E-mail address ballot lottery international program held in Great Britain on the 1st of April 2010 is out. Your e-mail account have been picked as a certified winner of a lump sum pay out of £1,550,952.00.(One Million Five Hundred And Fifty Thousand Nine Hundred And Fifty Two Pounds Sterling) credited to MICRO (LOTTERY) CHIP NO:9465206. This is from a total prize money of £8,612,170 GBP shared amongst the (5) international winners in this category "A" ballot lottery. You are therefore advice to contact our claims agent for validation:
THE BENEFICIARY/OWNER OF THE WINNING EMAIL SHOULD COMPLETE OUR CLAIMS FORM.
1. FULL NAMES OF BENEFICIARY:
2. RESIDENTIAL ADDRESS:
3. DATE AND PLACE OF BIRTH:
4. PHONE/FAX NUMBERS:
5. NAME AND ADDRESS OF NEXT OF KIN:
6. MICRO (LOTTERY) CHIP NUMBER:
7. OCCUPATION:
8. MARITAL STATUS:
9. SEX:
10. NATIONALITY:
11. AMOUNT WON:
You are to contact the Claims Consultant with the details below:
Contact Person: Mr. Godwin Allyson.
Email : m.corporation@w.cn
Tel: +(44)-704-570-5663
Yours Sincerely,
Dr (Mrs) Elizabeth Andre
On-Line Coordinator, Microsoft Mega Jackpot Lottery
UNITED KINGDOM.
ELECTRONIC MAIL AWARD PROMOTION.
The Microsoft Mega Jackpot Lottery, United Kingdom wishes to inform you that the results of the New Year E-mail address ballot lottery international program held in Great Britain on the 1st of April 2010 is out. Your e-mail account have been picked as a certified winner of a lump sum pay out of £1,550,952.00.(One Million Five Hundred And Fifty Thousand Nine Hundred And Fifty Two Pounds Sterling) credited to MICRO (LOTTERY) CHIP NO:9465206. This is from a total prize money of £8,612,170 GBP shared amongst the (5) international winners in this category "A" ballot lottery. You are therefore advice to contact our claims agent for validation:
THE BENEFICIARY/OWNER OF THE WINNING EMAIL SHOULD COMPLETE OUR CLAIMS FORM.
1. FULL NAMES OF BENEFICIARY:
2. RESIDENTIAL ADDRESS:
3. DATE AND PLACE OF BIRTH:
4. PHONE/FAX NUMBERS:
5. NAME AND ADDRESS OF NEXT OF KIN:
6. MICRO (LOTTERY) CHIP NUMBER:
7. OCCUPATION:
8. MARITAL STATUS:
9. SEX:
10. NATIONALITY:
11. AMOUNT WON:
You are to contact the Claims Consultant with the details below:
Contact Person: Mr. Godwin Allyson.
Email : m.corporation@w.cn
Tel: +(44)-704-570-5663
Yours Sincerely,
Dr (Mrs) Elizabeth Andre
On-Line Coordinator, Microsoft Mega Jackpot Lottery
Comments:
Related Cyber Criminal Profiles:
No related profiles found.Similar Spam Examples:
Lottery Scam - The Msn/Yahoo LotteryLottery Scam - Dear UNCC Beneficiary ! ! ! !
Lottery Scam - CONTACT MR. MARK VAN JAS
Official UK National Lottery Scam - Lucky Winner!!!
Bank Draft Scam - Good Day
Related Malware Samples:
No related malware samples found.[Previous Example] [Share This Page] [Back To The Main SHPAMEE Index] [Next Example]
A New Year blah blah blah on the 1st of April? Man, these scammers really need to get over the New Year celebrations (or perhaps their New Year starts on the 1st of April). These lottery scammers are a bunch of lunatics and that is no April Fool's joke.
Whoa! That's a mouthful! Next time try to spell the amount out in binary notation, it is more or less the same waste of time.
Contact Person: Mr. Godwin Allyson.
Email : m.corporation@w.cn
Tel: +(44)-704-570-5663
Right, let met get this straight. The so-called Claims Consultant has a British telephone number and a Chinese e-mail account. The IP address 75.87.220.151 is located in Appleton, Wisconsin and 64.26.60.144 in Chicago, Illinois. So both IP addresses are from the United States. The w.cn domain is privately owned (not by Microsoft) but is powered by Microsoft Windows Live. So why will someone use an e-mail service from a mail provider (we never heard of in our life) to conduct "official" business like this? Why will Microsoft use an e-mail address like m.corporation@w.cn or m.softcorporation.inc@live.co.uk or andre@ukelizabeth.com (which doesn't exist by the way), if they own the domain microsoft.com. The answer is simple, they won't and this e-mail did not come from Microsoft!
The m.corporation@w.cn and m.softcorporation.inc@live.co.uk e-mail addresses are disposable and the scammer can easily get rid of them when he is done with his scam (or if he gets caught). Should his e-mail account get suspended, he will simply create another account on live.co.uk or w.cn and start the scam all over. This is one of the main reasons why it is futile to close down a scammer's e-mail account. It is far better to keep it open so that investigators can monitor the scammer's movements. This also allows scambaiters to have a little fun with this mugu.