Possibably the Ultimate Scam

In my Excite account (e-mail) I received the following email. I haven't followed the links or checked anything out yet, but I know that Microsoft didn't send me this. (note this one of my junk mail accounts, so I haven't even santitized it.)
What do you think?

Quote:

---

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: (qmail 29928 invoked from network); 7 Oct 2004 13:02:32 -0000
Received: from unknown (HELO xprdmx9.nwk.excite.com) ([10.50.30.30]) (envelope-sender <[email protected]>)

by 0 (qmail-ldap-1.03) with SMTP

for <[email protected]>; 7 Oct 2004 13:02:32 -0000
Return-Path: <[email protected]>
Received: from servera01.cpsmtpout3.msn.com (servera01.cpsmtpout.msn.com [207.46.132.135])

by xprdmx9.nwk.excite.com (Postfix) with ESMTP id 565F417F44

for <[email protected]>; Thu, 7 Oct 2004 09:02:30 -0400 (EDT)
Received: from communications3.msn.com ([207.46.153.61]) by servera01.cpsmtpout3.msn.com with Microsoft SMTPSVC(5.0.2195.6713);

Thu, 7 Oct 2004 03:48:27 -0700
To: [email protected]
Message-Id: <[email protected]>
Date: Thu, 07 Oct 2004 03:48:27 -0700 (PDT)
From: Microsoft Windows <[email protected]>
[ Add to Address Book | Block Address | Report as Spam ]
Subject: Download SP2 today for a more secure PC
Content-Return: allowed
MIME-Version: 1.0
Content-Type: multipart/alternative;

boundary="----=_NextPart_AE0_B00_4560E222.01C4AC32"
X-OriginalArrivalTime: 07 Oct 2004 10:48:27.0357 (UTC) FILETIME=[2D3388D0:01C4AC5B]
X-FII-Tracking: 0.001554












Computer securityis an issue that concerns us all. That's why, as an important part ofour ongoing security effort, we've developed Microsoft®Windows® XP Service Pack 2 (SP2) with Advanced SecurityTechnologies. If you haven't already downloaded SP2, don't forget to get itfor free today.*

Service Pack 2provides proactive protection for Windows XP. Which means if you'rea Windows XP user, it's one of the most important things you can do tohelp protect your computer from all sorts of potential problems. Here'swhat you'll get:

• Moresecure Internet browsing and communication
Service Pack 2 includes enhancements to Microsoft Internet Explorer andan improved Windows Firewall that help block annoying pop-up ads andhelp guard against malicious viruses and hackers.

• More ofwhat you love about your computer
You'll get the latest updates and drivers for music, videos, Webbrowsing, gaming, and more.


•Simplified security controls
The handy new Windows Security Center puts all your security settingsin one central location.

Help your friendsand family protect their PCs from viruses and other potential securityproblems by forwarding them this e-mail and reminding them to downloadSP2 today.



Remember,the easiest way to get SP2 is by turning on your AutomaticUpdate.





To learn more andget Windows XP Service Pack 2,visit microsoft.com/protect today.
*Internet connect time charges may apply.

Please do not respond to this message, it has been sent from anunmonitored address.

© 2004 Microsoft Corporation. All rights reserved. Microsoft,Windows, and the Windows logo are either registered trademarks ortrademarks of Microsoft Corporation in the United States and/or othercountries.

This e-mail is intended for distribution within the United States.Please contact your local Microsoft Subsidiary for similar offeringsoutside the U.S.

Protect Your PC: 3 steps to help ensure your PC is protected
Microsoft wants to help ensure your PC is protected from viruses andworms like Mydoom and Blaster, as well as from future threats. Pleasego to www.microsoft.com/protect and follow these steps today.

1. Use an Internet Firewall
2. Update Your Computer
3. Use Up-to-Date Antivirus Software

To get more information and resources about how to help protect yourPC, go to www.microsoft.com/protect

You are receiving this message because youare a preferred Microsoft customer. If you have questions about ourprivacy policies, please read our privacy statement. privacy statement.

Microsoft Corporation
One Microsoft Way
Redmond, WA 98052


Message-Id:<[email protected]>

---

I will add more about it as I investigate it.
edit: ok I don't get it......the links do go to msn?

Ummm.... I couldn't help myself.


I clicked.

Maybe I'm lost or something, but I don't see the scam in this.. especially if the link goes to msn. Care to further explain, or do you only have/know the information provided?

Well, I only have the info provided but check out the spelling and typos for one thing.
1. "don't forget to get itfor free today"
2. "Help your friendsand family"
3. "More ofwhat you love about your computer"
Just to show a few....there are more, and I don't think MSN would allow something with those erros to go out.

Hrmm, then if it is a scam it sure isn't the "Ultimate Scam". For starter's, the spelling mistakes. Saying "Get it free?".. why free? Unless they are just trying to get credit card information or something along those lines. But it links back to msn? Blah..

I agree now, Spyder32......but it won't let me change the title.

This is from Sam Spade:

Quote:

---

10/09/04 22:13:04 whois [email protected]
.com is a domain of USA & International Commercial
Searches for .com can be run at http://www.crsnic.net/

whois -h whois.crsnic.net msn.com ...

Whois Server Version 1.3

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

MSN.COM.TW
MSN.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
MSN.COM

To single out one record, look it up with "xxx", where xxx is one of the
of the records displayed above. If the records are the same, look them up
with "=xxx" to receive a full display for each record.

>>> Last update of whois database: Sat, 9 Oct 2004 18:49:13 EDT <<<

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability. VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.

---

Quote:

---

MSN.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM

---

I take back what I said earlier.. :)

Could it be some sort of DOS attempt................get millions of people to try to download at once?

Or just because they won't be able to download (because of the traffic), they will be p1ssed off with Microsoft

It is a weird one

Maybe it's one of them public service announcements, like when celebrities tell you to vote.

Maybe they found an exploit in SP2 and they want everyone to download it to infect everyones computers??? Other than that, I'm just as confused..

Yeah, but even if there was an exploit in SP2, I doubt the benefit of it (to the cracker) would outweight having millions of unprotected computers out there ripe for the picking. SP2 fixes way to many of M$'s security issues.


Oh yeah... I decided to vote for Jennifer Anniston. Bush and Kerry are just creepy.

Quote:

---

Originally posted here by moxnix
Well, I only have the info provided but check out the spelling and typos for one thing.
1. "don't forget to get itfor free today"
2. "Help your friendsand family"
3. "More ofwhat you love about your computer"
Just to show a few....there are more, and I don't think MSN would allow something with those erros to go out.

---

i use SuSE and Konquerer. missing spaces between words. I get a lot of that in the email client from HTML emails.

try doing a trace route to the servers servera01.cpsmtpout3.msn.com and communications3.msn.com mentioned in the mail..... the last server is pos1-0.iuscixtukc1201.ntwk.msn.net before the request times out....

now do a tracert to www.microsoft.com.... the last server again is pos1-0.iuscixtukc1201.ntwk.msn.net before the request times out....

so basically the email seems to have originated somewhere from the microsoft's network.... now ofcourse that doesn't make the email totally legitimate :)

pl correct me if i'm wrong!!!!

Thats a weird one to crack. i have neavor seen one like that.

Rktak, I did a couple IP Block/WhoIs checks on a couple of the servers as well and found they were both part of registered domains of MicroSoft. (communications3 and servera01).
It appears as though the email originated from here:

Quote:

---

Received: from communications3.msn.com ([207.46.153.61])

---

which Sam Spade identifies as registered to Microsoft. That's not saying that someone couldn't have just injected a couple extra recieved: fields in order to make the email appear to have come from communications3.msn.com

The path of the email runs through these server exchanges (from what I can see):
communications3.msn.com
servera01.cpsmtpout3.msn.com
xprdmx9.nwk.excite.com
0 (qmail-ldap-1.03) (I'm not sure about this one)

The only actual exchange that seems to be a little odd is this:

Quote:

---

Received: from unknown (HELO xprdmx9.nwk.excite.com) ([10.50.30.30]) (envelope-sender <[email protected]> )
by 0 (qmail-ldap-1.03) with SMTP

---

If you look at Moxnix's WhoIs of this envelope sender, something seems somewhat fishy. In addition to that, if you do a WhoIs on xprdmx9.nwk.excite.com you'll see the IPs of the servers are not even remotely close to 10.50.30.30. That IP address actually belongs to IANA. Maybe I'm missing something?

Anyways, something else bothers me about this being an effective scam.

Quote:

---

Remember,the easiest way to get SP2 is by turning on your AutomaticUpdate

---

Why would they even bother putting this in here? very strange indeed.

Ahem... Girls and Boys.....

Quote:

---

10.50.30.30

---

Is indeed an IANA address..... Look at it really, really carefully and you will see that it fits rather nicely into the 10.0.0.0/8 IP address block that is private.

It would be almost impossible to spoof this address since all communication back to the initiator would be dropped by the internet routers, (MS' included), so this did indeed originate within the MS network.

I'm about to leave... I'll take another look in a minute....

[Edit]

It looks kosher to me....

Are you an MS Preferred Customer?

[/Edit]

Quote:

---

Received: from unknown (HELO xprdmx9.nwk.excite.com) ([10.50.30.30])

---

This seems very suspicious to me. The machine [xprdmx9.nwk.excite.com] is not identifying itself correctly. The associated IP address should not be resolving back to IANA but rather, some form of Excite's domains(I did a WhoIs on the server [xprdmx9.nwk.excite.com] and checked out the registered domains). Also, I believe the HELO field can be forged as well (if I remember correctly). This 10.50.30.30 is throwing me for a loop. Again, maybe I'm missing something?

Quote:

---

Originally posted here by Tiger Shark
Are you an MS Preferred Customer?

---

No Tiger, except for getting a couple of free disks from them, I haven't comunicated with MSN in along time, and I don't think I used my excite account to do that.
It still strikes me as a fake. If anyone wants to see the original email with the html intact, just pm me an email addy and I will forward it to you, and then maybe you can see what I mean.
moxnix

Mox... ahah.... I was going to ask if there was any html.....

Right near the top there will be a declaration of an image map. The image map covers a large area of the email itself.... as you run your cursor over the email you should notice that it is a hand rather than a pointer....

Am I correct?

If so the address the image map points to is where you will be sent..... That's why everything else looks really kosher.... because it is..... ;)

Tiger......nope, the only places it shows the link hand is on the links.

Mox:

Do me a favor... PM me the HTTP.... There isn't much in the headers that points anywhere other than legitimate sources except that the server xprdmx9.nwk.excite.com has no reverse DNS but that's quite possible if it is an internal server for mail transfer. Thus the only remaining clues would be in the HTML as far as I can see.

Ok, I just forwarded the email to anouther member in two different formats, and in the second one, the full html was displayed.
The typo's and such were corrected when the full html was displayed and it appears to actually be originated by MSN.

My browser settings must have stripped alot of the html out of the message, because what I first seen looked very suspect, but with the full html there, it looks legit.

Tiger, I don't know how to copy the full html out of the email. All I can get is the stripped down version. I just found out, I can forward the full thing....even the parts that my browser stripped.

edit> let me try forwarding it to another email account, perhaps I can copy it better from there.

TS: i have the original HTML. If mox doesnt get it to you I will. I kind of wish i were better versed in how frontpage does its coding. I cant spot anything actualy wrong or malicous after a very quick glance through it but damn this code seems screwy. Like a <font> tag on every paragraph. I would almost have to say this looks legit except i didnt think MS was in the habit of spam.

Ok. Firefox strips most of the html out of it also in my gmail account, so I guess ZomBieMann will have to send it to you.

Damn,

Quote:

---

You are receiving this message because you are a preferred Microsoft customer. If you have questions about our privacy policies, please read our privacy statement. privacy statement.

---

I wonder how that came about, especially to my Excite account???

Actualy Mox i was able to get the original HTML from gmail using firefox. Unless i am missing something. I just clciked on more options then clicked on show original and got what apeared to be the original HTML. I have already PM'd it to tiger shark and will PM it to anybody else who requests it. Like i said in my other post. I cant find anything wrong but something doesnt seem quite right either

Zombie:

Yeah, I'm not great at HTML code but I'd like to have a look if you have the complete code.

Mox: You said you have received a couple of CD's in the past from MS. It's quite likely that just the act of requesting one of them put you on that status. You sure you never gave the excite address to them when you signed up for one of those cd's.

i have been following this thread (god knows why?!) and i have to butt in and ask:

are we all sure we aren't seeing more than is actually there because we are looking for more than is actually there?

Secure:

No, I'm not.... But in order to make a determination I need all the information, the final part of which I just received.

Mox: It's all Genuine.... Congrats.... You are a Preferred Customer of Microsoft's....

Everything in the HTML is kosher. I even followed the links in there. The "danger" area is a button to turn on Automatic Updates and the link to windowsupdate.microsoft.com

The button takes you to protect.microsoft.com which is a verifiable MS site within their CIDR and the link genuinely takes you to windowsupdate.microsoft.com.

The only potential danger in those two, since they are links, would be DNS poisoning and that would have been a huge issue and would have been noticed immediately by the world as a whole.

Go ahead and get your SP2 Mox......

PS: Thanks Zombie

seems like happy ending to this one :).... except that if the email was really spam and was not originated from microsoft, then we may be in for a shock when next time the "initiator of the email" sends another similar email with the email text or links not being so friendly!!!!!!!!! :)....

I must have used the excite addy for the first CD I sent for......heh heh heh, the second CD was for SP2. I can't think of any other way MSN could have gotten that address. Guess I didn't trust MicroSoft about sendinfg a bunch of junk so used that addy.....lol

I followed the links also Tiger and found out they were legit. The only thing really throwing me was the typos and very unproffessional look, but that was apparently because of the way I had IE set up (I only use IE for Windows Update and excite -- excite wants to set too many cookies and I won't lower my Firefox setting enough for it to work with excite).

Snoockered by my own security settings....... :dunce:

after getteing a copy of the orignal e-mail i think that it is real even with all the errors because it dose say the best way to get sp2 is to turn on your automatic updates.