Hotmail Spam

[Speedy]

Latterly I am winning so many Lotto’s from hotmail accounts plus all the lost inheritances that I need to help people clear I just don’t know what I will ever do with all my new found wealth.

Is there no way that these fraudsters can be reported to Microsoft or is hotmail just a spammer’s paradise. It has reached a stage even through my anti spam software is sorting it for me its starting to make me furious as I know there are some people out there that will get caught up in this and taken for a ride. :angry:

[Wazoo]

... from hotmail accounts ...

Did you do any checking of the 'real' source of these things? It is very doubtful that these actuall came from 'HotMail' ... not saying they didn't, just doubtful. The impression here is that you're basing your remarks on the contents of the "From" line, which is a trivial forgery.

[Telarin]

Well, if you're in the US, you should forward copies of these to the USSS, as they handle this kind of fraud. The reporting address is 419.fcd[at]usss.treas.gov

Also, if the source IP address does resolve to hotmail, you may also want to forward a copy to abuse[at]hotmail.com or abuse[at]msn.com so they can close down the account. Unfortunately, spamcop only sends a report to the IP address that was used to send the email THROUGH hotmail, so hotmail never receives and abuse report, just the originating ISP (which is probably in Nigeria and doesn't care that someone is using them to run a scam).

Contrary to what Wazoo has said here, most of those hotmail addresses ARE real, as they expect you to reply by email to their message. Unless of course they tell you in the letter to send email to another address, in which case that will be the real address.

These can also be fun to play with for a while. See how long you can bait them on and how much of the scammers time you can waste. Remember, he is probably paying per minute to use an internet cafe, and any time he wastes on you is time not spent working over a real victim. Just be careful to never give them ANY real information. If you're good, you can keep these guys on the hook for months and waste many hours of their time.

[Miss Betsy]

If there is a hotmail address to reply to, the address can be reported to hotmail abuse. It takes patience, but eventually they pay attention. They will first tell you it isn't one of theirs (if the source of the spam is from somewhere else), but after several reports, they finally get the message.

There are several hilarious exchanges where people have strung the scammers along somewhere on the web, but don't go to Nigeria. I believe they killed someone who did. You need to be really savvy to play games with them.

However, I wish I had the time and could feel safe doing it! One guy actually got the scammer to send him a $3.50 mail order. I told my sister about your FRIEND and she was so UPSET. "HELP those people," she said, "DO it RIGHT NOW!"

Miss Betsy

[Speedy]

Thanks for the advice here is a copy of my Lotto win

Return-Path: <pjfzkucmrio[at]hotmail.com>

Delivered-To: telkomsa_net-bbsa[at]telkomsa.net

Received: (qmail 12656 invoked from network); 26 Mar 2007 18:18:00 -0000

Received: from unknown (HELO mx4.hotmail.com) ([196.34.113.107])

(envelope-sender <pjfzkucmrio[at]hotmail.com>)

by O (qmail-ldap-1.03) with SMTP

for <bbsa[at]telkomsa.net>; 26 Mar 2007 18:17:55 -0000

From: "Gylith Adwaumwen" <lzpprrv4f5[at]hotmail.com>

Subject: [spam] AWARD NOTIFICATION

To: bbsa[at]telkomsa.net

Content-Type: text/plain

Date: Mon, 26 Mar 2007 20:18:11 -0800

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-MSKTag: [spam]

X-MSK: UF

UK INTERNATIONAL LOTTERY

PO BOX 1011

LIVERPOOL, L70 1NL

UNITED KINGDOM.

FROM: THE DESK OF THE PROMOTIONS MANAGER, INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPARTMENT,

REF: EKS255125600304 AND BATCH NO: 54/1017/I

AWARD NOTIFICATION

We are pleased to inform you of the announcement today, 2nd of March,

2007 of winners of THE UK INTERNATIONAL LOTTERY PROGRAMS held on 1st of March 2007 as part of our second quarter of the year bonanza.

You have won the UK International lottery; your ticket number

034-1416-4612 750, with serial number 6521-11 drew the lucky numbers 31-51-22-24-39-43, and Consequently won the lottery in category C.

You have therefore been approved for a lump sum pay out of US$1.2Million in cash credited to file REF: EKS255125600304. This is from total prize money of US$16,800,000.00 shared among 14 winners in this category. All participants were selected through a computer balloting system drawn from 25,000 names from Middle East, Asia, Africa, Canada, Europe and North America and Oceania as part our International Promotions Program, which is conducted annually.

CONGRATULATIONS!

Your fund is now deposited with EQUITY INVESTMENT LIMITED, a finance company, insured in your name. Due to the mix up of some numbers and names, we ask that you keep this award strictly from public notice until your claim has been processed and your money remitted to your account. This is part of our security protocol to avoid double claiming or unscrupulous acts by participants of this program.

We hope with a part of your prize, you will participate in our end of year high Stakes US$1.3 billion International Lottery.

To begin your claim, please contact your claims agent;

MR. MARK JOHNSON

EQUITY INVESTMENT LIMITED,

132 BLACKBURN ROAD,

BOLTON BL7 9RP ENGLAND,

UK.

TEL:447045706905

EMAIL: equity28[at]hotmail.com

for due processing and remittance of your prize money to a designated account of your choice.

Remember, you must contact your claim agent immediately, if you do not contact then, all funds will be returned as unclaimed. All correspondences to MR. MARK JOHNSON, should be sent by email, and must have this EMAIL sent along with it and also, your FULL ADDRESS, YOUR COUNTRY OF RESIDENCE and your EMAIL ADDRESS to which this email is sent, should be clearly and BOLDLY WRITTEN IN YOUR RESPONSE with your claims agent.

NOTE: In order to avoid unnecessary delays and complications, please remember to quote your reference and batch numbers in every correspondences with your agent. Furthermore, should there be any change of your address, do inform your claims agent as soon as possible.

Congratulations again from all our staff and thank you for being part of our Promotions program.

Sincerely,

SHIRLEY JENSEN.

THE PROMOTIONS MANAGER,

THE INTERNATIONAL LOTTO UK

N.B. Any breach of confidentiality on the part of the winners will result to Disqualification. Please Contact your claim agent at: equity28[at]hotmail.com

[Speedy]

And this is what I get back from them when reporting the spammer

Thank you for reporting spam to the MSN Hotmail Support Team. This is an auto-generated response to inform you that we have received your submission. Please note that you will not receive a reply if you respond directly to this message.

Unfortunately, we are unable to assist you because the account for which you have sent a complaint is not an MSN-hosted account.

If you need information about how to configure and take more advantage of your Hotmail Junk E-mail Filters please visit the following website:

http://help.msn.com/help.aspx?mkt=en-us&am...oc_SetUpJMF.htm

If you need further information about MSN Hotmail’s efforts and technologies used to fight spam and abusive e-mails please visit:

http://postmaster.msn.com/cgi-bin/dasp/pos...=FightJunkEmail

[Farelf]

Yep, that looks to be from Hotmail right enough. In which case the lzpprrv4f5[at]hotmail.com address "has to be" (IIUC) real and, as Will (Telarin) has said, logically so too equity28[at]hotmail.com - so you can follow the process at http://www.hotmail.msn.com/cgi-bin/dasp/ua_info.asp?pg=faq to report. This particular scam (wording, "Shirley Jensen") has been around for some time but not always using Hotmail for the contact address - see http://www.sikkerhetstjeneste.com/scamlett...rley_Jensen.htm

I note the ticket number and the winning numbers are unchanged. Gee I might use those numbers in the next (real) Lotto. Just imagine the scammer's face if they won!

[Wazoo]

I simply deleted my first reaction at being forced to read your entire spam posting here .. biting my tongue at the rudeness involved. Not sure why you think you are the only person in the world that gets these things ... and ignoring that you missed the hints, suggestions, instructions to use a Tracking URL instead of postin a spam (ignoring that there are issues that a Tracking URL may not specifically address) ...

However, then one sees that Miss Betsy's last post was then also ignored.

As I suggested, the "From:" address is bogus.

As Will suggested, the "contact" address was not yet whacked when I checked it a bit ago.

However, Miss Betsy gave yu the heads-up on the all-too-typcal HotMail/MSN response .. then suggested what to do about it. This may all be new to you, but ... please read and take note of the data and information provided to you here.

And to go further, as stated above, this did not come "from" HotMail/MSN .. rather the parser wants to send a report to abuse[at]is.co.za based o the actual 'sending' IP address of 196.34.113.107 ...

One more step, there is a configuration that should be fixed .... the e-mail application involved could use some work, based on the ... by O (qmail-ldap-1.03) with SMTP for .... data in the headers.

[Farelf]

...As I suggested, the "From:" address is bogus.

As Will suggested, the "contact" address was not yet whacked when I checked it a bit ago.

However, Miss Betsy gave yu the heads-up on the all-too-typcal HotMail/MSN response .. then suggested what to do about it. This may all be new to you, but ... please read and take note of the data and information provided to you here.

And to go further, as stated above, this did not come "from" HotMail/MSN .. rather the parser wants to send a report to abuse[at]is.co.za based o the actual 'sending' IP address of 196.34.113.107 ...

One more step, there is a configuration that should be fixed .... the e-mail application involved could use some work, based on the ... by O (qmail-ldap-1.03) with SMTP for .... data in the headers.

Dang, yes I misread those headers - thought 196.34.113.107 was associated with Speedy, since it was a ZA origin. Sorry. "by O" instead of "by 0" (zero) was a touch of misdirection for me as well.