Outlook / Windows 8 lottery scam

For a long time I got only regular, boring, stupid scam emails. But this one seemed interesting as they didn't write an email as such, instead they attached a docx file with Outlook and Windows 8 graphic logos, as well as a graphic imitation of an official signature! The email itself seems to have been sent from an educational institution's email (.edu), but they ask to send your data to a free account (@live.com), so this is of course one more suspicious moment (not even mentioning the fact that I have never participated in any such lotteries). Unfortunately, there's no way to display the graphic part here or attach this file, so I just copied the text:

This is to inform you that you have email grant money of Eight hundred thousand USD for this month of 2014 sweepstakes which is organized by OUTLOOK, MSN & WINDOWS 8 LIVE INC. The MICROSOFT WINDOWS collects all the addresses of the people that are active online, among the millions that subscribed to Yahoo and Hotmail, Gmail we only select five people as our winners through electronic balloting System without the recipient applying, we salute you for being one of the people selected.
NOTE: FOR CLAIMS OF GRANT YOU MUST CONTACT THE EMAIL BELOW WITH YOUR INFORMATION TO OPEN YOUR CLAIMS FILE.
• Contact Email: ([email protected])
1. FULL NAMES: 2. HOUSE ADDRESS:
3. OCCUPATION: 4. SEX: 5. AGE:
6. DIRECT PHONE NO: 7. STATE: 8. COUNTRY:
Thank you and accept my hearty congratulations once again!
Send Your Details to Contact Email Only: [email protected]

And here are the headers of this scam:

Delivered-To: [email protected]
Received: by 10.76.169.196 with SMTP id ag4csp112052oac;
Sun, 6 Apr 2014 22:15:15 -0700 (PDT)
X-Received: by 10.69.1.69 with SMTP id be5mr1096421pbd.126.1396847715146;
Sun, 06 Apr 2014 22:15:15 -0700 (PDT)
Return-Path: <[email protected]>
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0242.outbound.protection.outlook.com. [207.46.163.242])
by mx.google.com with ESMTPS id eg2si7782412pac.264.2014.04.06.22.15.09
for <multiple recipients>
(version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Sun, 06 Apr 2014 22:15:15 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 207.46.163.242 as permitted sender) client-ip=207.46.163.242;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 207.46.163.242 as permitted sender) [email protected]
Received: from BN1PR04MB327.namprd04.prod.outlook.com (10.141.62.145) by
BN1PR04MB325.namprd04.prod.outlook.com (10.141.62.142) with Microsoft SMTP
Server (TLS) id 15.0.913.9; Mon, 7 Apr 2014 05:15:01 +0000
Received: from BN1PR04MB327.namprd04.prod.outlook.com ([169.254.16.120]) by
BN1PR04MB327.namprd04.prod.outlook.com ([169.254.16.120]) with mapi id
15.00.0913.002; Mon, 7 Apr 2014 05:15:01 +0000
From: Augusthy Kulakkattolickal <[email protected]>
Subject: email
Thread-Topic: email
Thread-Index: AQHPUiAzYcHY5kpIBEmQWAwC7lHP3Q==
Date: Mon, 7 Apr 2014 05:15:00 +0000
Message-ID: <b6634647584445da94a590fa92bbf47c@BN1PR04MB327.namprd04.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [116.202.139.226]
x-forefront-prvs: 0174BD4BDA
x-forefront-antispam-report: SFV:NSPM;SFS:(10019001)(6009001)(428001)(199002)(189002)(94946001)(81686001)(83322001)(74316001)(46102001)(54316002)(69226001)(74706001)(54356001)(81816001)(94316002)(95666003)(73894003)(53806001)(56776001)(85306002)(16236675002)(51856001)(19580395003)(74876001)(1671002)(74366001)(76482001)(87266001)(97336001)(47446002)(93516002)(99286001)(90146001)(221733001)(15975445006)(74502001)(99396002)(2656002)(93136001)(74662001)(98676001)(97186001)(50986001)(92566001)(20776003)(66066001)(76176001)(75432001)(77096001)(80976001)(79102001)(95416001)(59766001)(87936001)(81342001)(83072002)(86362001)(31966008)(85852003)(49866001)(77982001)(881003)(56816005)(76796001)(76786001)(63696002)(4396001)(76576001)(80022001)(33646001)(65816001)(47976001)(81542001)(47736001)(204593001)(42262001)(24736002)(217283001)(220243001);DIR:OUT;SFP:1102;SCL:1;SRVR:BN1PR04MB325;H:BN1PR04MB327.namprd04.prod.outlook.com;FPR:;MLV:nov;PTR:InfoNoRecords;A:1;MX:1;LANG:;
received-spf: None (: ccc.edu does not designate permitted sender hosts)
Content-Type: multipart/mixed;
boundary="_004_b6634647584445da94a590fa92bbf47cBN1PR04MB327namprd04pro_"
MIME-Version: 1.0
X-OriginatorOrg: ccc.edu

--_004_b6634647584445da94a590fa92bbf47cBN1PR04MB327namprd04pro_
Content-Type: multipart/alternative;
boundary="_000_b6634647584445da94a590fa92bbf47cBN1PR04MB327namprd04pro_"

--_000_b6634647584445da94a590fa92bbf47cBN1PR04MB327namprd04pro_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable



--_000_b6634647584445da94a590fa92bbf47cBN1PR04MB327namprd04pro_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

So I got this same email telling me that I was selected in a lottery that gmail,microsoft,windows8 was conducting and that I have won 500,000 in usd dollars and being that I once dated a guy that fell for one of those shadow shoppers scams, I am always skeptical about these kinds of emails. None the less I can't sleep tonight so I decided to see if I could find anything on this, and I came across this site, well someone posted the encrypted message and the original sender's ip address was recorded and guess what I found!!!!! DAMNED NEAR THE EXACT LOCATION WHERE THIS EMAIL ORIGINATED, ONCE I SAW INDIA I KNEW IT WAS INDEED A SCAM NOT THAT I DIDN'T KNOW ONCE I SAW THIS SITE AND ONE PERSON POSTED THE LINK TO MICROSOFT'S SITE AND A POSTING ABOUT THIS EXACT EMAIL SCAM, IT REALLY DISGUSTS ME HOW EVIL PEOPLE CAN BE OVER MONEY, WHAT BOTHERS ME MOST IS THAT SOMEONE HAS ENOUGH TIME IN THEIR LIFE TO THINK THESE THINGS UP, MAKES YOU WONDER WHAT KIND OF WORLD DO WE LIVE IN... SO HERE'S WHAT I FOUND



IP Address 116.202.139.226 Area Code 080
Country Code IN IDD Code 91
Country Name India India Time Zone +05:30
Region Karnataka ISP Pdsnnew1 Pdsn
City Bangalore Domain -
Report Error Report Incorrect Location Connection Type DSL
Coordinates Google Map 12°58'34"N 77°36'12"E Weather Station Code INXX0012
Postal Code 560018 Weather Station Name Bangalore
Weather Status View Live Weather


Need IP geolocation database for your web site? You can get it from IP2Location.com immediately.

Need IP address location detection service in your web site? You can get it from FraudLabs.com immediately.

Need multiple IP address to test the geolocation features of your web site? You can get it from LocaProxy.com now.

Need solution for credit card fraud detection? You can get it from FraudLabsPro.com now.

Need the world major cities database? You can get it from GeoDataSource.com now.

Find out more information about geolocation at Geolocation.com.

SO YEAH YOU CAN SAY I'M MIGHTY PLEASED WITH MYSELF FOR BEING ABLE TO DO THIS.. SO I WILL SHARE THE WEBSITE I FOUND THIS INFO ON BECAUSE I'M SICK TO DEATH OF INNOCENT GULLIBLE PEOPLE THAT FALL FOR THESE THINGS.

website is: http;//www.iplocationtools.com

I hope I can report this some how.. and hope I helped

SO I CAN'T SLEEP TONIGHT AND DECIDED TO LOOK DEEPER INTO THIS I FOUND THE PERSON IN INDIA I TRACED THE IP ADDRESS TO THIS WEBSITE CALLED
http://www.tcpiputils.com/browse/ip-add ... 02.139.226
IT POPPED UP EVERYTHING ON THIS IP ADRESS SO I DECIDED TO GOOGLE THE EMAIL IT PROVIDED AND THE SAME SCAM THING CAME UP BUT THE EMAIL WAS
SO I DUG DEEPER AND FOUND ALL OF THIS FROM THE TRACER SITE:

General information 116.202.139.226

IP address 116.202.139.226
Description PDSNNEW1-PDSN
Location India (IN) flag
Internet Registry (RIR) apnic




Network information

IP address 116.202.139.226
Reverse DNS (PTR record) not available
DNS server (NS record) not available
ASN number 131222
ASN name (ISP) MTS-INDIA-IN 334,Udyog Vihar,IN
IP-range/subnet 116.202.128.0/19
116.202.128.0 - 116.202.159.255
Network tools external website Ping 116.202.139.226
external website Traceroute 116.202.139.226



Hosting information

Number of domains hosted 0
Number of mail servers hosted 0
Number of name servers hosted 0




SPAM database lookup

db.wpbl.info not listed good
dnsbl-1.uceprotect.net not listed good
psbl.surriel.com not listed good
recent.dnsbl.sorbs.net not listed good
smtp.dnsbl.sorbs.net not listed good
Number of SPAM hosts on 116.202.128.0/19 93
external website More DNSBL lookups



Blocklist lookup

Adult hosting not listed good
Dshield droplist not listed good
Hackers, Spyware, Botnets etc. not listed good
Open proxy not listed good
Spamhaus droplist not listed good



Advertisements







Domains on 116.202.139.226

No domains found.



Domains around 116.202.139.226

No domains found.




Whois information

inetnum 116.202.128.0 - 116.202.159.255
netname PDSNNEW1-CHENNAI-MTS-INDIA-IN
descr PDSNNEW1-PDSN
country IN
admin-c SSTL1-AP
tech-c SSTL1-AP
status ASSIGNED NON-PORTABLE
mnt-by MAINT-MTS-INDIA-IN
mnt-lower MAINT-MTS-INDIA-IN
mnt-routes MAINT-MTS-INDIA-IN
mnt-irt IRT-MTS-INDIA-IN
changed [email protected] 20110214
source APNIC

irt IRT-MTS-INDIA-IN
address 334,Udyog Vihar, Phase-IV,Gurgaon-122001
e-mail [email protected]
abuse-mailbox [email protected]
admin-c SSTL1-AP
tech-c SSTL1-AP
auth # Filtered
mnt-by MAINT-MTS-INDIA-IN
changed [email protected] 20101108
source APNIC

role SISTEMA SHYAM TELESERVICES LTD - network administ
address 334,Udyog Vihar, Phase-IV,Gurgaon-122001
country IN
phone +911246784514
fax-no +91-124-4046487
e-mail [email protected]
admin-c SSTL1-AP
tech-c SSTL1-AP
nic-hdl SSTL1-AP
mnt-by MAINT-MTS-INDIA-IN
changed [email protected] 20090831
changed [email protected] 20090831
source APNIC

route 116.202.128.0/22
descr MTS-NEW-22-33
origin AS131222
mnt-by MAINT-MTS-INDIA-IN
changed [email protected] 20120920
source APNIC




Geo information

Location India (IN) flag
Latitude and Longitude 20, 77


NOW I TYPED THE EMAIL IN GOOGLE AND THIS IS WHAT I GOT:

in.linkedin.com/pub/dr-goyal/10/982/4a5

you are 100% correct I got a similar email if not the same exact email you posted earlier today an like you I knew immediately something was fishy even the big names they used didn't fool me for a second that's how I stumbled upon this forum is I was doing my research to confirm my suspicions I could see there whole strategy on how they were trying to lure gullible victims in there trap from the big names to the big prizes it had scam written all over it if there's one thing iv learned in my 32yrs on this planet it's if something seems too good to be true often times it is to good too be true I was one of the 5 lucky ducks who won 500k an a Apple laptop well lucky ole me then I feel special lol no way Jose was I giving them my information an I saw where you said you don't see how they got that much time on their hands to send out scam emails to gullible victims my guess is they don't manually send them out they have robots do it for them an it must can detect the most active accounts because that's there best target for easy cash is hoping somebody will get back to them quicker reason I think that is I'm on a few social networks and I get robot mail all the time sometimes it's profiles of pretty girls actin like there lonely bored ect to try to lure me to their website I block them every time it wouldn't surprise me a bit the same people that's behind those social network scams is the same people who is behind this Gmail Microsoft lottery scam I see a lot of similarities in the strategy they use I bet I'm right an yea there's a lot of evil people out there that's too sorry to work for a living an that's why they come up with these ridiculous internet scam ideas an thanks for all the info an links you posted I hope it enlightens the gullible minded ones that's if there lucky enough to visit this forum first before they do anything stupid an once again thanks for sharing

Hi. New here. I just received this exact scam this morning, and since the last post was July 4, I guess it's safe to assume that whoever these people are, they're still going at it. I didn't trace the email back, like a few of you did, but instead I went straight to Google to see if it was legit or not, even though my gut was already telling me that it's a scam. I wanted Google to confirm it. Then I happened upon this site, and promptly reported the email for phishing.

[AlanJones]

^^^Please do not report the email addresses to the providers in future, it is counter-productive and makes posts on this forum useless.

It will take the scammer 30 seconds to set up a new email address and carry on with his scamming and future victims who search the new email address (like you did) won't find a warning as we may not know about the new address and may end up losing money.

[AlanJones]

Windows 8 lottery scam mails being sent by [email protected] with a reply to of [email protected].

I just got this email today. I do not understand why why these people attack the little guy why not go for the big guns who have the major information... thank goodness I opened the email on my phone not my computer! Just wanted the community to know that it is back and to look out. the last post I saw was in august so now being January I thought I would let you all know.

Welcome to Scamwarners pwilliams73_1,

What was the email address the scammer used?

Hi, I received this scam email this morning.

The email they are using in my case is [email protected]
and the email tells me I have won £800,000.

Content of email is:

Your Email ID has been selected by Google & Microsoft Promotion board to receive the sum of Eight
hundred thousand Great Britain Pound Sterling (£800,000.00) and Apple Laptop by Gmail Promotion
in conjunction with the Microsoft Outlook Window 8. We collect all the Gmail addresses of the people
that are active online among the people that subscribed to Gmail and various Microsoft window
users, we only select five people every year as our winners, without the winner applying , we are
congratulating you for being one of them.
However you will have to fill and submit the below information to the events manager
1. Full Name:
2. Address:
3. Telephone Number:
4. Occupation:
5. Country:
6. I............................................................ hereby
Declare that the above information is true and binding on me. If at any time it is discovered that I
have given false information, I will forfeit my rights to my winnings.
Contact Events Manager Lottery Department Submit your information to the company email stated
below
Contact Email: [email protected]
Thank you and accept my hearty congratulations!
Warm Regards,
Engr. Pedro Simon


If only!

This same scam is still running its course...

(original email sent from: Frederick Jonathan Manson <[email protected]>)

[Gmail logo] [Windows 8 logo]
Dear Winner,

We are pleased to inform you of your winning sum of Five Hundred Thousand United States Dollars with an Apple laptop by Gmail Corporation, in conjunction with Microsoft Windows 8. We collect all the email addresses of the people that are active online; among the people that subscribed to Gmail and various Microsoft Windows users. We only select five people annually as our winners, without the winner applying and we are also congratulating you for being one of them.

However you will have to fill and submit the below information to the events manager

Reply To This Email Only: [email protected]

1. Full Name:
2. Contact Address:
3. Age:
4. Telephone Number:
5. Sex:
6. Occupation:
7. State:
8. Country:

Contact the Events Manager Department
Submit your information to the email given above
Events Manager: Mr.Thompson Mark

I just wanted everyone to stay informed.

hi every one. I got a scam attempt today. Like the others it read:

Your Email has been selected among other 4 others for this year draw by Microsoft Outlook Window 8 in collaboration with the Gmail Intl. We collect all the emails that are active online among the people that subscribed to Gmail and various Microsoft window users we are congratulating you for being one of them, as you have been approved to receive a sum of One Million Five hundred thousand GBP and Apple Macbook Pro Laptop.



Kindly fill and submit the information below to the promotion manager

Full Name;

Occupation;

Country;

Address;

Tel / Cell #;


I............................................................ hereby

Declare that the above information is true and binding on me. If at any time it is discovered that I have given false information, I will forfeit my rights to my winnings.


Submit your information only to the promotion manager company information stated below


NAME: Mrs. Joyce Medford

Email: [email protected]


Thank you and accept my hearty congratulations!

I just received this email with the exact type of scam. It was sent to my personal gmail email Removed (BW).

I have copied and pasted the text of this email below for your review. It did have the windows 8 logo with other official logo at top and sent as a .docx file that required a download prior to opening.

This is to inform you that you have email grant money of Eight hundred thousand USD for this month of 2014 sweepstakes which is organized by OUTLOOK, MSN & WINDOWS 8 LIVE INC. The MICROSOFT WINDOWS collects all the addresses of the people that are active online, among the millions that subscribed to Yahoo and Hotmail, Gmail we only select five people as our winners through electronic balloting System without the recipient applying, we salute you for being one of the people selected.

NOTE: FOR CLAIMS OF GRANT YOU MUST CONTACT THE EMAIL BELOW WITH YOUR INFORMATION TO OPEN YOUR CLAIMS FILE.
Contact Email: ([email protected])
1. FULL NAMES: 2. HOUSE ADDRESS:
3. OCCUPATION: 4. SEX: 5. AGE:
6. DIRECT PHONE NO: 7. STATE: 8. COUNTRY:
Thank you and accept my hearty congratulations once again!
Send Your Details to Contact Email Only: [email protected]

This scam is back once again. I saw the previous post was Jun 26, 2015. So I felt compelled to let everyone know.

I received this same scam email this morning from [email protected]. The bad guys are still out there!