17 February 2005 Blog Home : February 2005 : Permalink
FROM: THE DESK OF THE E-MAIL PROMOTIONS MANAGER,
INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPARTMENT
MICROSOFT WORD LOTTERY, UK
3b Olympic Way, Sefton Business Park,
Aintree, Liverpool, L30 1RD
E-mail:[email protected]
The first thing that an enquiring mind notes is that mapping sites can't find a 3b Olympic Way in Aintree and in offering suggestions indicate that Aintree's postcode is L10 not L30. Curiously though, a UK postcode lookup site shows that the postcode belongs to the UK lottery company Camelot Group plc, who list the above address as one of their regional offices. Could it be that the Microsoft Word Lottery was outsourced to Camelot? or did someone forget to alter the address from a previous phishing letter?
The second thing - noted by Tim himself is the mswordpromo.com is registered to a Colorado address and again things look slightly plausible in that the admin phone number areacode is 303 which is indeed a Colorado area code. Unfortunately it goes wrong immediately after that because the number is too long1-303-617-393468 is 12 digits not 10). Also the dig records indicate that the mail server for mswordpromo.com is hotmail.com
;; mswordpromo.com. IN MX
;; ANSWER SECTION (1 record)
mswordpromo.com. 600 IN MX 10 pamx1.hotmail.com.
;; AUTHORITY SECTION (2 records)
mswordpromo.com. 172800 IN NS pdomns1.msn.com.
Somehow I doubt that a true microsoft operation would be receiving email via hotmail and using the MSN personal domain service for its hosting, although it is true that msn and hotmail are owned by Microsoft.
REF NO: MSW-L/200-334841
BATCH: 2005MJL-01
ELECTRONIC MAIL AWARD WINNING NOTIFICATION
We are pleased to inform you of the announcement today of winners of the
MICROSOFT WORD E-MAIL MEGA JACKPOT LOTTERY PROGRAMS held on 11th JANUARY
2005.
Ooops - the whois record shows the domain was registered on 5 February 2005 yet the draw took place on 11th January 2005. Shurely shome mishtake?
Your company or your personal e-mail address is attached to winning
number 11-20JAN-2005-02MSW, with serial number S/N-00179 drew the lucky
numbers 887-13-865-37-10-83, and consequently won in the first lottery
category.
Oh dear, now this really is sloppy. Googling on the lucky numbers shows that the same lucky numbers have been "won" by lots of people where the contact email domain is ms-wordpromos (note the added hyphen) how much work is it to change the lucky number each time you send out the spam?
You have therefore been approved for a lump sum pay out of GBP
1,000,000.00 POUNDS in cash credited to file REF NO: MSW-L/200-334841 This
is from total prize money of GBP 25,000,000.00 POUNDS, shared among the
Twenty five (25) international winners in this category.
Stylistic quibbles: GBP 1,000,000.00 POUNDS and GBP 25,000,000.00 POUNDS seem to belong to the Dept of Redundancy Department style and surely if you write twenty five (25) you should also write One Million pounds (GBP 1,000,000.00)
All participants were selected through our Microsoft computer ballot
system drawn from 21,000 names, 3,000 names from each continent, as part
of International "E-MAIL" Promotions Program, which is conducted once in
every four years for our prominent MS WORD users all over the world, and
for the continues use of E-mail. We are sorry to let you know that our
site is still under construction,as we are updating our site and our
windows 2005.
21000 names, 3000 per continent == 7 continents. Africa, Europe, Asia, N America, S America is five. Oceania (Australia/NZ/pacific) could be the sixth but Antarctica must be number 7. Unless the penguins have a hidden desire to run Microsoft word despite being Linux mascots I seriously doubt there are 3000 MS words users in Antarctica. The "site under construction" excuse is pretty weak too, surely you could just copy the official MS word site and hack it a bit?
Your fund has been deposited in an escrow account with our affiliate bank
here in UK, and insured with your REF NO: MSW-L/200-334841 and your E-mail
address, Please note that, you are to contact us via email as we are
promoting the use of E-mail,You have the right to call the bank, as we
will provide you with the necessary details on how to claim your prize.
You are to keep your ref. number and batch number from the public, until
you have been processed and your money remitted to your personal account.
Oops after getting lots of english right the grammar starts to slip. Fund not funds? in UK? insured vs secured? not to mention abusing commas worse than anything outside a Terry Pratchett book. The same goes for the rest of the email. Such a shame really to see such hard work and effort come to nothing just be a little sloppy text editing and our friend Mr Google...
(Also noted by Tim Worstall)