Afraid this is a Scam

My friend got an email from this company, offering her Office Pro Plus for $39.00. She thought it was a good deal, so went for it. I'm not so sure it's legit, since the product key doesn't seem to work. Also, I've never heard of Microsoft Softwares LTD.

Here's a screenie of the confirmation.

From: Microsoft Softwares LTD <noreply@sendowl.com>
Date: Thu, Apr 30, 2020 at 1:46 PM
Subject: Order #####
To: maryyouknowwhoxxx at email addy

Hi Mary,

Thanks for ordering from us. This email confirms your order of the following items:

Microsoft Office 2019 Professional Plus for Windows PC x 1

Your Order ID is ##### and your payment has now cleared. A receipt has been emailed to you separately.

You can download your digital products from the following link:

**REMOVED LINK**

Microsoft Office 2019 Professional Plus for Windows PC license key:

Product Key

If you run into any installation problems or similar, please contact us at:

support@microsoftsoftwares.com

Sincerely,

Microsoft Softwares Team

Thanks for any information y'all can provide.

Microsoft Softwares Team

No professional company would make a plural out of an uncountable noun...

You could suggest she examine or send you the email header. E.g. (part):
Received-SPF: pass (zohomail.com: domain of mail.tenforums.com designates 54.240.27.154 as permitted sender) client-ip=54.240.27.154; envelope-from=01010172d791b2ed-7fa31b6f-0c88-4cc8-abdc-5c74e6b7ec8f-000000@mail.tenforums.com; helo=a27-154.smtp-out.us-west-2.amazonses.com;
Authentication-Results: mx.zohomail.com;
dkim=pass;
spf=pass (zohomail.com: domain of mail.tenforums.com designates 54.240.27.154 as permitted sender) smtp.mailfrom=01010172d791b2ed-7fa31b6f-0c88-4cc8-abdc-5c74e6b7ec8f-000000@mail.tenforums.com;
dmarc=pass(p=none dis=none) header.from=tenforums.com
ARC-Seal: i=1; a=rsa-sha256; t=1592754550; cv=none;
d=zohomail.com; s=zohoarc;
b=e0TXZxXs29DN6beR8jG1fp3lqEB6bEu7gqrowO67xoxYUduONIqP5hh+OX+9CmaizzFqvAoZnxrxVcTNXjySeJ3+nW4FiXPoYB PVnAlNCFmLS1mdqqoaKZgMAx2imrex3TSon4X4bMs5Kq94smGiOwFTlGRPjaChKjoTVPkJXcQ=
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc;
t=1592754550; h=Content-Type:Content-Transfer-Encodingate:From:MIME-Version:Message-ID:Reply-To:Subject:To;
bh=8u4dThz4BLfHJyyVQt94TTbusTsFRXaT9POr3XHyQx0=;
b=BxyeiJcV6VRmyfN9RH40iktRGRaSjpixlgYaA4BByQ4yvBYBjMZO0pLpFRh7qjtVkV2xqe2ix4Mu6Or+yuLNX3FChIsdbLY7Wj ZfAdqdMtyFp2Pi2bdNzB3YmhiJDL0RzcTH40cQCNd3UCM79yNxL3VRjfcjki6KAAqiCW1C8eE=
ARC-Authentication-Results: i=1; mx.zohomail.com;
dkim=pass;
spf=pass (zohomail.com: domain of mail.tenforums.com designates 54.240.27.154 as permitted sender) smtp.mailfrom=01010172d791b2ed-7fa31b6f-0c88-4cc8-abdc-5c74e6b7ec8f-000000@mail.tenforums.com;
dmarc=pass header.from=<support@tenforums.com> (p=none dis=none) header.from=<support@tenforums.com>
Received: from a27-154.smtp-out.us-west-2.amazonses.com (a27-154.smtp-out.us-west-2.amazonses.com [54.240.27.154]) by mx.zohomail.com
with SMTPS id 1592754550315273.2334793235957; Sun, 21 Jun 2020 08:49:10 -0700 (PDT)
Return-Path: <01010172d791b2ed-7fa31b6f-0c88-4cc8-abdc-5c74e6b7ec8f-000000@mail.tenforums.com>

dalchina said:

No professional company would make a plural out of an uncountable noun...

You could suggest she examine or send you the email header. E.g. (part):

Thanks, Dalchina.

She sent me the whole email and I looked online for the company name. Looks like they have been guilty of using MSDN subscription keys in the past. Maybe not this time, though.

I couldn't find where to check if the key is legitimate, except to install and enter the key. Which I did, and it seems to pass muster; it was accepted and activated.

I have warned her that although everything seems OK, it could be that sometime in the future, Microsoft will discover that the key is MSDN and pull her license. Or not and everything is just fine.

At this point, I don't know what else to do; if Microsoft accepts it as legit, who am I to say it's not.

I assume you changed something and did not actually post her email address in your OP because that could be abused.

That order link takes you straight through without any account signin-in procedure to an Office 2019 product key which could now be abused.

All the best,
Denis

no no no! dont touch. I fell foul of these long time ago. Its a hacking rip off. They install Office via the net; then give you a key. The key stops after a few days because it is generated by them randomly, not by MS. Is there an address for this company? The one that got me was in Hounslow London, then they moved to Bournemouth. They even have a Microsoft Acredited badge on their site. This particular one above is California, but its the same thing.

xsteveuk said:

I would advise to remove all instances of microsoftsoftwares.com
My adguard - Gives the message
This web page at microsoftsoftwares.com Microsoft Softwares LTD has been reported as a malware page and has been blocked based on your security preferences.
The support link on the email you posted

Sigh . . . As much as I caution my students, it looks like I'm caught.

I downloaded onto the USB drive.

Just goes to show , That even the Best can still be caught off guard

Well, I knew better.

I've been going back and forth with myself on whether to do a clean install or not; guess this experience has made me decide.

She had already tried to install, and some strange things were/still are going on with the computer, so I'm betting she's already infected.

I was beginning to wonder how she could mess up a brand new computer so badly, and I think I know how now . . . This isn't her first computer, far from it, and she's never had this much trouble before.

Thanks, Dalchina, Try3, elbmek, and xsteveuk. I'm convinced . . . especially since I'm finally connecting the dots. Sigh . . .