Welcome to www [  [ net!

· Home
· AvantGo
· Content
· coppermine
· Feedback
· Forums
· Help Desk
· Journal
· Members List
· Private Messages
· Recommend Us
· Search
· Statistics
· Stories Archive
· Submit News
· Surveys
· Top 10
· Topics
· Weather
· Web Links

     Who's Online
There are currently, 15 guest(s) and 1 member(s) that are online.

You are Anonymous user. You can register for free by clicking

     Content Categories
· Features (2)
· InfoSec (2)
· Spicey Chicken Cartel (8)

     Help Desk


Sugar Land, Texas, United States, North America
Change Settings
Current Conditions:

Feel: 84°F
Wind: SSE
5 mph
Detailed Forecast

 It's a ''Lotto'' Bull!

spam, Skewered

It seems that, as fast as the authorities stomp on the current online Make $$$$MONEY$$$$$ Fast! scheme, a new way to separate the foolish from the contents of their pocketbooks surfaces. From 'David Rhodes' to 'Christopher Erickson' and 'Karen Liddell', from 'Gifting Clubs' to 'AS SEEN ON NATIONAL TV', from the parents of the teenager who found $70,000 in his closet to the 'Nigerian gummint offishul' who has $3,141,596.25 MILLION USD he needs your help spiriting out of the country (with believe in God), my inbox has seen them all. Far, far too many of them.

So, I was fairly drooling with anticipation when I saw the following little jewel show up recently. (OK, the drooling may be a result of that 'getting old' thing.) It has been soooo long since I have had a new type of MMF to skewer. So, I looked at it, and sure enough... it is not only one of the recent 'foreign lottery' scams to make the rounds, but it is even a variant that hasn't been reported to death already! Oh, goodie goodie goodie...

So without further ado, the moment you have all been waiting for: the spam...

From Sun Nov 9 15:42:58 2003
Return-Path: []
Received: from psmtp.com ( [])
by (8.10.2/8.10.2) with SMTP id hA9Lgul10790
for [ed.truitt AT .net]; Sun, 9 Nov 2003 15:42:56 -0600
Message-Id: []
Received: from source ([]) by ([]) with SMTP;
Sun, 09 Nov 2003 13:42:57 PST
To: ed.truitt AT .net
Date: Sun, 09 Nov 2003 22:42:51 +0100
MIME-Version: 1.0
Status: RO
Content-Length: 2321
Lines: 58

Ref. Number:
Batch Number:


We are pleased to inform you of the result of
the Lottery Winners International programs held on the
2 of september 2003. Your e-mail address attached to ticket number
6 with serial number 27-321 drew
lucky numbers which consequently won
in the 2nd category, you are therefore been approved
for a lump sum of payment of US$ 500,000 (FIVE HUNDRED THOUSAND
Due to mix up of some numbers and names, we ask that
you keep your winning information confidential until
your claims have been processed and your money Remitted
to you. This is part of our security protocol to avoid
double claiming and unwarranted abuse of this program
by some participants.
All participants were selected through a computer
ballot system drawn from over 10,000 company and
23,000,000 individual email addresses and names from
all over the world. This promotional program takes
place every three year.
This lottery was promoted and sponsored by some
eminent personalities who do not wish to declare their
identity for security reasons. We hope with part of
your winning you will take part in our next year (USD1
To file for your claim, please contact our fiducially Agent PATRICK FOSTER
TEL:0 Email: ()
Remember, all winning must be claimed not later than
15th of december 2003. After this date all unclaimed funds will be
included in the next stake.
Please note in order to avoid unnecessary delays and complications, remember
to quote your reference numberand batch numbers in all correspondence.
Furthermore, should there be any change of address do inform our agent as soon as possible.
Congratulations once more from our members of staff and thank you for being part of our promotional program.
Note: Anybody under the age of 18 is automatically disqualified.

Sincerely yours,
Lottery Coordinator

The dissection begins. First of all, this appears to originate from IP , and when I do check the reverse lookup, I get the following result: domain name pointer node-c-110b.a2000.nl.
An IP in the Netherlands. It appears to be a 'direct to MX' spam, as there is no indication than my mail server received this from an SMTP server, and the 'Message-ID' header indicates the first SMTP server to see them email is mine.

Next, the time zone in the 'Date:' header is +0100 - that is, UTC plus 1 hour. This is the same time zone used in the Netherlands (and other countries on that side of the English Channel.)

Then, I see the telephone number of the 'fiducially Agent' - the first 4 numbers (0031) are the country code, and 0031 is the country code for the Netherlands. Strike 3!

So, it appears the email came from a luser in the Netherlands. The land of tulips, windmills, discarded syringes littering the park across from the Royal Palace, and that mysterious lockbox mentioned in some of the 'Nigeria 419' scams.

Now, how about the content? Well, to begin with, I don't know what a 'fiducially Agent' is, but produced 306 hits - all of them associated with some international lottery email, many of them including the word 'scam'. It must be a highly specialized niche service,to help people seeking to Make $$$$MONEY$$$$$ Fast! using the Internet and a bulk e-mailer program.

And, what about 'Lottery Winners International'? Here, a spat out some 2,730 hits, some having to do with this type of spam email, others (interestingly) shilling various products (printers, phones, etc) along with -- you guessed it -- International Lottery Winners! I suspect these may be some type of spoof/parody sites, as several of them are in the UK (and we all know what the British sense of humor is like ;-)

What about this sentence: ''This lottery was promoted and sponsored by some eminent personalities who do not wish to declare their identity for security reasons.'' I wonder of those security reasons include 'because they know this is an illegal scam, and they do not want to go to prison for a long time.' That would sure be enough of a reason for me to want to keep my identity a secret.

And, what about this paragraph:

Due to mix up of some numbers and names, we ask that you keep your winning information confidential until your claims have been processed and your money Remitted to you. This is part of our security protocol to avoid double claiming and unwarranted abuse of this program by some participants.
Let's see, they select their winners from a 'computer ballot system' populated with email addresses (can you say 'harvested email addresses CD'? I knew you could), yet are concerned about abuse of the program? Wow, maybe they should take a page out of Diebold's play book, and just claim copyright violations under the DMCA if someone files a double claim. Besides, the 'winning information' was sent in clear text via an email system - not exactly the idea way to transmit super sensitive information.

So, while this isn't the ''Spammish Bull'' scam that is quite the rage, it sure seems to be a close cousin - a rip-off of a rip off (an oxymoron if ever I heard one.) My guess is that, if someone with visions of $$$$MONEY$$$$$ swimming in their heads actually calls or emails 'PATRICK FOSTER', then a scenario similar to that found in the 'Nigeria 419' scam will be played out: up front money will be asked for, followed by 'special fees', followed by more 'special fees', followed by yet more 'special fees', until the mark is milked dry, and the nest egg has disappeared.

Am I the only one who thinks this way? Actually, no. Here is an excerpt from the US Postal Service website:

It's illegal. A federal statute prohibits mailing payments to purchase any ticket, share, or chance in a foreign lottery.

And, there is am excerpt from the Better Business Bureau website:

Typically, those who pay the required fees never see any lottery tickets or any other evidence that lottery tickets were purchased on their behalf. In some cases, the soliciting company uses high pressure telemarketing techniques to obtain credit card account numbers. Once they have the numbers, repeated unauthorized transactions are made to the accounts.
Hmmm, I'll bet they don't honor the 'Do Not Call' list, either...

Anyway, the bottom line is this: Don't fall for this scam. If you do, you will Lose $$$$MONEY$$$$$ Fast!, and may be the recipient of a stern lecture by the US Postal Inspectors.

Do You Feel Lucky Today? Well, Do You???

Don't have an account yet? You can . As a registered user you have some advantages like theme manager, comments configuration and post comments with your name.

     Related Links
· More about spam, Skewered
· News by etee

Most read story about spam, Skewered:
URGENT 'Nigeria-419' Scam from South Africa

     Article Rating
Average Score: 5
Votes: 1


 Printer Friendly Page  Printer Friendly Page

 Send to a Friend  Send to a Friend

"Login" | | 0 comments
The comments are owned by the poster. We aren't responsible for their content.

No Comments Allowed for Anonymous, please

Web site powered by PHP-Nuke

All logos and trademarks in this site are property of their respective owner. The comments are property of their posters, all the rest © 2003 by
You can syndicate our news using the file backend.php or ultramode.txt
Web site engine's code is Copyright © 2003 by PHP-Nuke. All Rights Reserved. PHP-Nuke is Free Software released under the GNU/GPL license.
Page Generation: 0.913 Seconds