1 December 2004
avoid saprizo.com
It's strange searching Google and finding no results at all for something. Moreover it is strange to 'whois' a domain and find that it is available, despite the fact that it resolves to an existing address. I'm getting ahead of myself, though.
Today I found an interesting message in my inbox, with the unassuming subject line "You've won a Microsoft X-Box, (This is not spam)." I was immediately suspicious (but also curious, since it had made it through my filters) so I opened it cautiously. The sender was unfamiliar, and I doubted that I could win a contest I never entered. Click below to see the text of the email and the rest of what I found.
Return-path: <administrator@saprizo.com>
Envelope-to: --me--
Delivery-date: Tue, 30 Nov 2004 23:53:09 -0800
To: --me--
From: "Saprizo" <administrator@saprizo.com>
Message-ID: <2004-lzckqqge.lzckqqge-lzckqqge.ilwsvlpz.mail@saprizo.com>
Date: Wed, 1 Dec 2004 07:52:50 +0000 (GMT)
X-SA-Exim-Connect-IP: 129.105.16.56
X-SA-Exim-Mail-From: administrator@saprizo.com
Subject: You've won a Microsoft X-Box, (This is not spam).
Content-Type: text/html
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13)rawhide.frogspace.net
X-Spam-Status: No, score=4.8 required=5.0 tests=BAYES_60,DCC_CHECK,HTML_20_30,
HTML_MESSAGE,MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,
RCVD_IN_BL_SPAMCOP_NET,YOU_WON autolearn=disabled version=3.0.0
X-Spam-Level: ****
X-SA-Exim-Version: 4.1+cvs (built Mon, 18 Oct 2004 15:55:05 -0700)
Greetings,
Your email address was entered into our Microsoft X-Box promotional competition at
http://www.Saprizo.com
This is a prize draw, you have actually won a brand new Microsoft X-Box Gaming Console!
Your package also includes these top 5 games:
- Halo: Combat Evolved
- Grand Theft Auto Double Pack
- Madden NFL 2004
- Prince of Persia: The Sands of Time
- Tom Clancy's Rainbox Six 3
You are now invited to login to our website and claim your prize that you have won.
There are only 3 winners in total this month, out of thousands of emails, so do count yourself lucky!
We have provided the following web link for you, it is temporary and expires in 72 hours.
If you do not login within this time, your X-Box shall unfortunately be returned to the prize pool.
Here is your link!
--link removed--
On this page you will need to enter this pass code number to proceed:
204197
This is very important. Do not lose that number!
Put in your address, and we will send your X-Box to you.
We hope that you will enjoy your new X-Box gaming console.
Best Regards,
From Microsoft and the Saprizo.com team!
So I tried the link, after removing as much personal information from it as possible. I ended up at saprizo.com, which whois tells me is unregistered.
Hmm, that's odd.
Please note that following these links is quite possibly very stupid. I do not encourage you to do this, though I am providing them anyway.
I ended up here, once I stripped away the frames and changed my email address: http://www.saprizo.com/cgi-bin/server.cgi?registrant=garbage@in.garbage.out&code=a&xm=1
I typed in my special code to get to this: http://www.saprizo.com/cgi-bin/server.cgi?entrycode=204197®istrant=garbage%40in.garbage.out&xm=0&enter=enter
Which still looks legitimate, I suppose. There's an address form, and then these paragraphs:
Due to several people attempting to hack our website to claim free prizes, we now require that you pay for shipping costs as verification that you are an actual winner. We apologize for this inconvenience but it is to make sure that YOU get your X-Box, not someone else!
You will only be charged for the shipping option that you select below. The X-Box itself is of no charge.
People hacking their website? Nearest I can tell it just now sprung into being. I read on and immediately was sure that this is a scam:
Shipping: Shipping option: 12-01-04: At this time only debit card transactions are able to be processed, due to technical reasons. We hope to have credit card processing online as soon as possible. Thank you kindly for your patience.
Card Type: Card Number: Expiry Date: PIN
Don't worry, I stole only their form, not the stuff behind it. They want debit cards and PINs? Oh yeah, like I would hand that information out on an insecure site that seems to be somewhere in, oh, I don't know, Korea somewhere (66.41.135.100). Sign me right up.
So I surfed back around the site, and ended up sending them an email asking if there was any possible way to pay without a debit card. I'll update this if Kento Kawaguchi or one of his colleagues ever reply, but I'm not holding my breath.
I just didn't find anything about the site when I searched Google nor does the domain reveal anything. Please feel free to add comments below or link to better information.
