I'm RICH!

[GreyGeek]

I won $500,000 and a new Apple computer. To claim my winnings all I have to do is send my personal info to
gmcrst@outlook.com1

Imagine that! What could be easier?
The email contained only a docx attachment. No text. I used ARK to look at it.
X-Originating-IP:223.227.9.227 is in Gurgaon, India. Probably a hacked computer. I notified the admin responsible for phishing and spamming attacks.

This email is to inform you that your Gmail address has won you prize money of $500,000.00 and an Apple Laptop for this month of September 2014 lottery promotion, which is organized by GMAIL & MICROSOFT OUTLOOK LOTTERY INC & WINDOWS 8.MICROSOFT WINDOWS collects all the Gmail addresses of the people who are active online; among the people who subscribed to Gmail and Outlook. Gmail, we only select five people every year as our winners through an electronic balloting system without the winner applying. We congratulate you for being one of the people selected.

NOTE: CONTACT THE EMAIL BELOW WITH YOUR INFORMATION.
Contact Email: gmcrst@outlook.com
1. FULL NAME:
2. HOUSE ADDRESS:
3. OCCUPATION:
4. SEX:
5. AGE:
6. DIRECT PHONE NO:
7. STATE:
8. COUNTRY:
Thank you and accept my hearty congratulation once again!

The complete header contains:

Return-Path: <greygeek77+caf_=greygeek77=neb.rr.com@gmail.com >
Received: from dnvrco-pub-iedge-vip.email.rr.com ([107.14.70.244]) by dnvrco-fep24.email.rr.com (InterMail vM.8.04.01.13 201-2343-100-167-20131028) with ESMTP id <20140905051048.KCEX12014.dnvrco-fep24.email.rr.com@dnvrco-pub-iedge-vip.email.rr.com> for <greygeek77@neb.rr.com>; Fri, 5 Sep 2014 05:10:48 +0000
Return-Path: <greygeek77+caf_=greygeek77=neb.rr.com@gmail.com >
Received: from [209.85.220.181] ([209.85.220.181:61061] helo=mail-vc0-f181.google.com) by dnvrco-iedge05 (envelope-from <greygeek77+caf_=greygeek77=neb.rr.com@gmail.com >) (ecelerity 3.5.0.35861 r(Momo-dev:tip)) with ESMTP id D8/84-31162-7D549045; Fri, 05 Sep 2014 05:10:48 +0000
Received: by mail-vc0-f181.google.com with SMTP id le20so434256vcb.26 for <greygeek77@neb.rr.com>; Thu, 04 Sep 2014 22:10:47 -0700 (PDT)
X-Received: by 10.220.113.148 with SMTP id a20mr1195761vcq.30.1409893847429; Thu, 04 Sep 2014 22:10:47 -0700 (PDT)
X-Forwarded-To: greygeek77@neb.rr.com
X-Forwarded-For: greygeek77@gmail.com greygeek77@neb.rr.com
Delivered-To: greygeek77@gmail.com
Received: by 10.52.82.164 with SMTP id j4csp29198vdy; Thu, 4 Sep 2014 22:10:45 -0700 (PDT)
X-Received: by 10.140.30.74 with SMTP id c68mr13825322qgc.63.1409893845119; Thu, 04 Sep 2014 22:10:45 -0700 (PDT)
Received: from smtp.centurylink.net (mail.centurylink.net. [205.219.233.9]) by mx.google.com with ESMTPS id b6si243291qcc.45.2014.09.04.22.10.44 for <greygeek77@gmail.com> (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 04 Sep 2014 22:10:45 -0700 (PDT)
Received-SPF: pass (google.com: domain of subii@centurylink.net designates 205.219.233.9 as permitted sender) client-ip=205.219.233.9;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of subii@centurylink.net designates 205.219.233.9 as permitted sender) smtp.mail=subii@centurylink.net; dkim=pass header.i=@centurylink.net; dmarc=pass (p=NONE dis=NONE) header.from=centurylink.net
DKIM-Signature: v=1; a=rsa-sha1; d=centurylink.net; s=ctl201402; c=relaxed/simple; q=dns/txt; i=@centurylink.net; t=1409893841; h=From:Subjectate:To:MIME-Version:Content-Type; bh=sg3EyJOStscVUyrAPtYSVY1vgrE=; b=uoIJqf54tuaa7EpV/QsEscMwnU4JBoq2pGCBOefbYs8REyau+CfdxCWtFcg7CRPh BRZ9PKPThK8SqNfKSmA/c7ZHroZlSib2PBa4yB+Dh9VPJBiB+vNgXIei4yXX0vkg udZ+0H82DVQyDBfEllnQfFp/t68b5FGQdy5FdevHTzewG1417hcBfYz5PX/EMTRv YIyX8ZePYATC6W+e6kvrKdWi+oAUjxoJ91TBr1vUUecyxtKJer axzAvIxbCQYyIc uG4XElxk9RDmCdkn/b0GvrfZNhKixNthmGVUSgMgWbfYSAFWdNcpNxMN6WIttLlW REPVGCPLHUgRpQiUoXdN+w==;
X_CMAE_Category: , ,
X-CNFS-Analysis: v=2.0 cv=F4bVh9dN c=1 sm=1 a=FKkrIqjQGGEA:10 a=YTHtZiAxaJsA:10 a=olU3X8F_VdkA:10 a=I_5RNyk1AAAA:8 a=gv4l6aEeuxxzeCLns_sA:9 a=QEXdDO2ut3YA:10 a=_W_S_7VecoQA:10 a=ZQsVYYh7dxUA:10 a=i4PDXFCCRecA:10 a=Z0vwQnTE3ZwA:10 a=6LiXq_q72ne8_QFweEkA:9 a=IKIoO-ieCDEA:10 a=zLzno4ilJRxFgvUXMpLPGQ==:117
X-CM-Score: 0
X-Scanned-by: Cloudmark Authority Engine
X-Authed-Username: c3ViaWlAY2VudHVyeWxpbmsubmV0
Received: from [10.40.66.5] ([10.40.66.5:40871] helo=md60.agate.dfw.synacor.com) by smtp.centurylink.net (envelope-from <subii@centurylink.net>) (ecelerity 3.5.1.37854 r(Momo-dev:3.5.1.0)) with ESMTP id C4/CB-01320-BC549045; Fri, 05 Sep 2014 01:10:36 -0400
Date: Fri, 05 Sep 2014 01:10:35 -0400
From: Google Award <subii@centurylink.net>
To: info <info@gmail.com>
Message-ID: <222876165.11424728.1409893835417.JavaMail.root@ce nturylink.net>
In-Reply-To: <2002818076.11424710.1409893824332.JavaMail.root@c enturylink.net>
Subject: Message
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_11424724_485780846.1409893835409"
X-Originating-IP: [223.227.9.227]
X-Mailer: Zimbra 7.2.2_GA_2852 (ZimbraWebClient - FF3.0 (Win)/7.2.2_GA_2852)
X-RR-Connecting-IP: 107.14.64.105:25
X-Authority-Analysis: v=2.1 cv=Z4BiHRhA c=1 sm=1 tr=0 a=JalCCKLaSqZXv92cY7s0UQ==:117 a=ayC55rCoAAAA:8 a=0oj8HZZGiqAA:10 a=FKkrIqjQGGEA:10 a=YTHtZiAxaJsA:10 a=olU3X8F_VdkA:10 a=I_5RNyk1AAAA:8 a=1XWaLZrsAAAA:8 a=K-v-2zaBAAAA:8 a=KGjhK52YXX0A:10 a=6BrDaJ5WXvREvQ-J4T4A:9 a=QEXdDO2ut3YA:10 a=_yIcqTN_Vdb6fKnb5_4A:9 a=_W_S_7VecoQA:10 a=ZQsVYYh7dxUA:10 a=i4PDXFCCRecA:10 a=Z0vwQnTE3ZwA:10 a=iwpBl5XnFHpWscNjirEA:9 a=IKIoO-ieCDEA:10
X-Cloudmark-Score: 0

[sithlord48]

oh wow your so lucky congradualtions on your winning.. lol . and i thought i was lucky when the prince from some country i never heard of sent me emails lol

[Qqmike]

S-O-B, d*. I haven't been so lucky. Informed by 'Out of Area' tele call to my land line, by a computerized voice, that an IRS tax investigator got me for tax fraud, tax evasion, tax audit, arrest (a police officer would be knocking at my door any minute), and other things. And YOU got half a mil! Lucky dog.

;-)


(Yes, I did report their (I presume, from on-line comments) India 1-800 # to the IRS investigative division ... after I saw many people reporting same scam on-line ...)

[MoonRise]

S-O-B, d*. I haven't been so lucky. Informed by 'Out of Area' tele call to my land line, by a computerized voice, that an IRS tax investigator got me for tax fraud, tax evasion, tax audit, arrest (a police officer would be knocking at my door any minute), and other things. And YOU got half a mil! Lucky dog.

;-)


(Yes, I did report their (I presume, from on-line comments) India 1-800 # to the IRS investigative division ... after I saw many people reporting same scam on-line ...)

Got something siliar to that here too. Though these people actually left messages. Couldn't really understand much other than they made a point to clearly say IRS and WILL BE PROSECUTED.

[SteveRiley]

1. FULL NAME: Ralph Roisterdoister.
2. HOUSE ADDRESS: #1
3. OCCUPATION: Homeless rocket surgeon.
4. SEX: Frequently.
5. AGE: I don't care how old you are, age is just a number. What really counts is on the inside.
6. DIRECT PHONE NO: Transylvania 6-5000.
7. STATE: Inebriated.
8. COUNTRY: No, I prefer the city life.

[GerardV]

1. FULL NAME: Ralph Roisterdoister.
2. HOUSE ADDRESS: #1
3. OCCUPATION: Homeless rocket surgeon.
4. SEX: Frequently.
5. AGE: I don't care how old you are, age is just a number. What really counts is on the inside.
6. DIRECT PHONE NO: Transylvania 6-5000.
7. STATE: Inebriated.
8. COUNTRY: No, I prefer the city life.

Please refrain from stealing my identity

Thank you

Regards,
Ralph Roisterdoister

ps
Update #4: Annually

[NickStone]

Scam Microsoft IT Support call
http://forums.cnet.com/7723-6122_102...tag=CAD5920658
To listen to the phone call please be aware that the recording does have some very bad language
https://app.box.com/s/0yluyszg1qj2l83ynbm2