Spyware Warrior Spyware Warrior
Help with Spyware, Hijacking & Other Internet Nuisances
FAQ :: Search :: Memberlist :: Usergroups :: Register
Profile :: Log in to check your private messages :: Log in

419ers: Winning the Microsoft lottery...

Post new topic   Reply to topic    Spyware Warrior Forum Index -> Spam
View previous topic :: View next topic  
Author Message
Expert Developer

Joined: 27 Jan 2006
Last Visit: 02 Dec 2010
Posts: 1157
Location: yes

PostPosted: Thu Jun 28, 2007 10:31 am    Post subject: 419ers: Winning the Microsoft lottery... Reply with quote

Me wonders what this friendly Nigerian scammer was smoking when he composed this rather delusional message:

Ref. Number:WRH/12726/PZP
Batch Number:29/064701/904HM


Sir/ Ma/ Miss,

We are pleased to inform you of the result of the winners of the Infinity Lottery Promotions programs held on 23rd June,2007.Your e-mail address attached to ticket number 085---2356789--789 with serial number 8567--46 drew lucky numbers 9- -01-23455-34 which consequently won in thecategory A.You have therefore been approved for a lump sum pay of US
$1.200,000.00(one million two hundred thousand United States Dollars)in cash credited to file Ref. Number:WRH/12726/PZP.This is from a total cash prize of US $16.800,000.00usd international winners in this category.

Due to mix up of some numbers and names we ask that you keep your winning information confidential until your claims has been processed and your money remitted to you.This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants. All participants were selected through a computer ballot system drawn from over 20,000 company and 30,000,000 individual email addresses and names from all over the world.This promotional program takes place every three years in different developed countries,the lottery was promoted and sponsored by the president of the world largest softwares to increase the awareness of microsoft software packages.We hope with part of your winning you will take part in our next USD 40 million international lottery.

To file for your claim please contact our financial agent MR GARY GUNTER, Foreign Operations Manager of the International
Remmitance Department Holland{netherlands}with your tel/fax numbers and a copy of your ID for age verification, telephone and fax numbers.8.00 am to18.00 gmt m
FAX:+31-84 7177-624

Remember all winning must be claimed not later than 5th July, 2007. After this date all unclaimed funds will be included in the next stake. Please note in order to avoid unnecessary delays and complications please remember to quote your reference number and batch numbers in all correspondence. Furthermore, should there be any change of address do inform our agent as soon as possible. Congratulations once more and thank you for being part of our promotional program.

Note:Anybody under the age of 18 is automatically disqualified.

Sincerely yours,


(emphasis added by me)

So Mr. Steve Ballmer himself is official sponsor of promo actions involving spam sent via hijacked proxies to harvested email addresses in order to raise people's awareness about Microsoft products? I don't quite believe this and neither should you, the recipient of such notifications Wink

Email headers:

Delivered-To: <recipient>
Received: by with SMTP id 12cs13117wxz;
Tue, 26 Jun 2007 02:16:01 -0700 (PDT)
Received: by with SMTP id p14mr2973469hud.1182849360714;
Tue, 26 Jun 2007 02:16:00 -0700 (PDT)
Return-Path: <infinitylottery@yahoo.de>
Received: from yahoo.de ([])
by mx.google.com with SMTP id d26si4766418nfh.2007.;
Tue, 26 Jun 2007 02:16:00 -0700 (PDT)

Received-SPF: neutral (google.com: is neither permitted nor denied by domain of infinitylottery@yahoo.de)
Message-ID: <C467BF96.31396EF@yahoo.de>
Date: Tue, 26 Jun 2007 14:15:04 +0400
From: "INFINITY LOTTERY" <infinitylottery@yahoo.de>
User-Agent: Mutt/1.2.5i
MIME-Version: 1.0
To: "Webmaster" <recipient>
Subject: Notification
Content-Type: text/plain;
Content-Transfer-Encoding: 7bit

Note the fake helo with posing as yahoo.de. Of course any ip-address starting with 200. belongs to LACNIC so this is not really a good fake. It resolves to Static-IP-cr20011811657.cable.net.co. AHBL lists it as an Open Proxy and it can also be found in APEWS, SORBS, Spamhaus and many more.

Back to top
View user's profile Send private message
Site Admin

Joined: 27 Jul 2003
Last Visit: 19 Feb 2018
Posts: 10420
Location: at the beach

PostPosted: Thu Jun 28, 2007 2:48 pm    Post subject: Reply with quote

Ha... whatever is in his KoolAid must be good.
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    Spyware Warrior Forum Index -> Spam All times are GMT - 8 Hours
Page 1 of 1

Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

smartBlue Style © 2002 Smartor
Powered by phpBB © 2001, 2002 phpBB Group