Dumb/lazy 419ers, again

["Rob, grandpa of Ryan, Trevor, Devon & Hannah" <rmslade () shaw ca>]

Nothing particularly novel in this one, but it caught my eye, and, what the heck, 
it's Friday in New Zealand ...

> Received: from coaatleon.es (212.183.204.45.static.user.ono.com 
[212.183.204.45])

Somebody in Spain apparently wants to scam me.

> From: "THE BC-49 MILLION LOTTO"<[somebody on a spam 
list]@btinternet.com>
> Subject: THE BC-49

This caught my eye, because I do live in BC, even though I've never played the 
BC49.  (It does exist.)

> THE BC-49 MILLION LOTTO
> LOTTO PROMOTION 
> HEAD OFFICE
> 10 Friendly Street United Kingdom

OK, I don't care how friendly the street is (and is there only one "Friendly" street 
in the UK? famous enough that we don't need a town?), and, yes, Her Majesty *is* 
the head of state (not government) for Canada, but we do run our own lotteries.  
(Yeah, I know, upstart colonials ...)

> On behalf of CANADA BC-49 Millions Lottery/Lotto Promotion United Kingdom; I

BC-49 is a provincial lottery.  649 is (one of) the *Canadian* national lottery.

> wish to announce you as one of the 7 lucky winners in the Lotto draw held on
> 3rd January 2010 and was announced March 23rd 2010.

Both BC-49 and 649 draws are held twice a week, Wednesdays and Saturdays.  I 
note that neither of these dates were a Wednesday or Saturday.  Draws are 
announced immediately, at 9 pm on the date, not ten weeks later.

> All 5 winning addresses
> were randomly selected from a batch of 20,000 international emails.

Both BC-49 and 649 are standard lotteries: you pay ($1 for BC-49) when you 
purchase a ticket.  Email is not involved.  (Although you can, now, buy tickets 
online.)

> Your
> email address emerged along side 6 others as a 2nd category winner.
> Consequently, you have therefore been approved for a total pay out of
> GBP.680, 000.00 (Six Hundred and Eight thousand British Pounds only). 

Interesting.  The top prize in BC-49 is $2M, or about UKP1.25M, second level is 
C$75K, or about UKP50K.

> (II) Winning 1 2 11 32 36 39 Bonus 12

This does look like the format for winning numbers for BC-49, but has nothing to 
do with email  :-)

> MR JUBRIL AMEEL
> BC49 Claims Office London United Kingdom.
> EMAIL:bc49ukclaimofficeuk2010 () gmail com
> Contact Tel: + 447924517831

Yeah, right ...

> Forward the below listed details for immediate commencement of your payment
> process:- 

And maybe we're doing some phishing, too ...

> Ms Lorraine Cinderella

Yeah, right ...

> The Lotto Awards is proudly sponsored by the African/European Union Lotto
> Corporation/Microsoft Companies, the Intel Group, Toshiba, Dell computers
> Mackintosh and a conglomeration of other international IT companies in order
> to promote the FIFA 2010 World Cup to be hosted in SOUTH AFRICA. The lotto
> internet draw is organized to encourage the use of the internet and
> computers worldwide. We are proud to say that over 200 Million Dollars are
> won annually in more than 150 countries worldwide. 

The government lotteries are often noted as sponsoring local amateur sport, but, 
as far as I know, have nothing to do with the World Cup (which also has little to 
do with sport ...)

> http://www.canada.com/findit/lotteries/results.aspx?id=6 

Actually, I thought this was a smart move, sort of confirming that BC-49 did 
really exist.  However, the parameter is wrong (should be id=4), and, in any case, 
there are no current results for either search.

> CONFIDENTIAL NOTICE: This email message, including any attachments, is
> intended only for the use of the intended recipient(s) and may contain
> information that is privileged, confidential and prohibited from
> unauthorized disclosure under applicable law. If you are not the intended
> recipient of this message, any dissemination, distribution or copying of
> this message is strictly prohibited. If you received this message in error,
> please notify the sender by reply email and destroy all copies of the
> original message. 

Argh.  Even spammers are putting stupid disclaimers on messages ...

======================  (quote inserted randomly by Pegasus Mailer)
rslade () vcn bc ca     slade () victoria tc ca     rslade () computercrime org
Allowing an unimportant mistake to pass without comment is a
wonderful social grace.                              - Judith Martin
victoria.tc.ca/techrev/rms.htm blog.isc2.org/isc2_blog/slade/index.html
http://blogs.securiteam.com/index.php/archives/author/p1/
http://www.infosecbc.org/links http://twitter.com/rslade
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.