Slog - Comments on Spam or Threat? A New Game. http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game From: mianga@xxxxxx.net Date: April 22, 2008 6:58:34 PM PDT Subject: she has already gone to hospital!... To: brendan@thestranger.com Hello, brendan. Listen to me carefully, i don't know what your name is, but i'll find you and i'll cripple you, because this is you who tempted her!!! She has already gone to hospital, you're next. mianga... Copyright 2008 Wed, 23 Apr 2008 10:04:14 -0800 Thu, 24 Apr 2008 09:23:46 -0800 http://www.movabletype.org/?v=3.34 http://blogs.law.harvard.edu/tech/rss Comment by king ad hock you should write back to mianga and say
"Dearest Mianga,
I don't know your name, but I am already crippled. Thanks."

]]> king ad hock http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004490 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004490 Mailbag Wed, 23 Apr 2008 10:09:38 -0800 Comment by bma Funny... I thought you knew his name was Brendan!

]]> bma http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004492 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004492 Mailbag Wed, 23 Apr 2008 10:09:57 -0800 Comment by monkey Dear Brendon, I don't know what your name is?

I'm going with Spam.

]]> monkey http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004495 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004495 Mailbag Wed, 23 Apr 2008 10:13:25 -0800 Comment by monkey Oops, Brendan.

SEE? I really don't know your name... er... uhm, he really doesn't know your name.

]]> monkey http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004496 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004496 Mailbag Wed, 23 Apr 2008 10:14:14 -0800 Comment by Andrew You should say "You ain't got the balls to put me in the hospital bitch!!"

Always ALWAYS aggitate the person who threatens you.

]]> Andrew http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004497 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004497 Mailbag Wed, 23 Apr 2008 10:14:32 -0800 Comment by JC A quick Google of that phrase shows several other sites with that exact message. You can probably stop looking over your shoulder.

]]> JC http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004499 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004499 Mailbag Wed, 23 Apr 2008 10:15:06 -0800 Comment by Lobot Spam.

]]> Lobot http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004501 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004501 Mailbag Wed, 23 Apr 2008 10:15:16 -0800 Comment by Fifty-Two-Eighty Definitely a kook. And I'd definitely write him back. Be sure to use lots of profanity when you do.

]]> Fifty-Two-Eighty http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004502 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004502 Mailbag Wed, 23 Apr 2008 10:15:51 -0800 Comment by Will in Seattle Oh, and dare them to use a gun when they attack you ... that always ends well ...

]]> Will in Seattle http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004506 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004506 Mailbag Wed, 23 Apr 2008 10:18:59 -0800 Comment by superyeadon threatening spam is the best.

]]> superyeadon http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004512 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004512 Mailbag Wed, 23 Apr 2008 10:22:06 -0800 Comment by Son of Mianga mmmm Brendan who's name I do not know, send me your bank account number and I, the son of Mianga, an African prince will deposite $100,000,000. But if you don't, I'm comming for you, even though I can't leave Africa unless you give me your bank account information because my father has been killed by the government. Don't tell anyone!

]]> Son of Mianga http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004522 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004522 Mailbag Wed, 23 Apr 2008 10:28:01 -0800 Comment by JMR it's from New Jersey (the address is still happily sitting in our RSS readers despite your subsequent effort to block it out) so it's a Threat.

]]> JMR http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004530 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004530 Mailbag Wed, 23 Apr 2008 10:34:41 -0800 Comment by w7ngman They probably have a huge list of first names and a huge list of domain names to put together into likely email addresses, or just a list of emails to begin with. There are no links in it right? This seems like bait to get you to reply so they know your email is being read. In the email list black market, I'd imagine emails known to be "active" in the last however long are worth more than emails simply lifted from the web.

]]> w7ngman http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004535 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004535 Mailbag Wed, 23 Apr 2008 10:37:28 -0800 Comment by Fnarf Please don't email it back. The "From" addresses in spam are forged too, and if it's a real address, as it sometimes is, you'll be forwarding the spam to that person, who is innocent. I know; I'm being joe-jobbed right now by someone (~4000 bounces a day directed to me).

Email doesn't come from email accounts; it comes from email servers. It's not "from" anybody; that's just a courtesy header.

]]> Fnarf http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004539 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004539 Mailbag Wed, 23 Apr 2008 10:38:57 -0800 Comment by w7ngman Fnarf is right, and it isn't even the email in the "From" header that you would be replying to, it's the "Reply-to" header. Both can be made up.

]]> w7ngman http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004556 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004556 Mailbag Wed, 23 Apr 2008 10:48:54 -0800 Comment by catnextdoor @14

OH! So THATS where all this weird spam is coming from... I've been wondering how I all of the sudden got buttloads of spam this week. The horror.

]]> catnextdoor http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004557 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004557 Mailbag Wed, 23 Apr 2008 10:49:13 -0800 Comment by bs Very much spam. I got 2 of them to a non-existant email address at a domain I own, both from different spoofed yahoo addresses. It wasn't even sent to a first name, unless "dkabpoyas" is a common first name that I've just never come across before.

I found the concept of threatening spam odd enough that I emailed it to some interested friends. Why would I want to see images of "her" in the hospital??? (Mine included this url: http://orfeyrecords.508.com1.ru/images/ )

]]> bs http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004562 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004562 Mailbag Wed, 23 Apr 2008 10:50:33 -0800 Comment by infrequent i like this new game. but do you win by getting spam or by getting a threat?

]]> infrequent http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004574 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004574 Mailbag Wed, 23 Apr 2008 10:56:16 -0800 Comment by Fnarf They're not "from" any yahoo addresses, nonexistent or otherwise. They're from one of the millions of infected PCs in the botnets that are sending out trillions of spams. These PCs are sending direct-to-MX with no client, no "from", no nothing, without the users' knowledge.

Virtually all email traffic is spam now; it's at least 99%, probably 99.999%. Most INTERNET traffic is spam now.

]]> Fnarf http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004576 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004576 Mailbag Wed, 23 Apr 2008 10:57:17 -0800 Comment by infrequent passive spam.

]]> infrequent http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004585 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004585 Mailbag Wed, 23 Apr 2008 11:06:34 -0800 Comment by LaDeeLa Oh no!! If you read that email you will get genital warts! Oh no I probably have genital warts! It says here I must forward this email to 22 people to get the cure.

Jesus fucking mary! that was close.

]]> LaDeeLa http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004586 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004586 Mailbag Wed, 23 Apr 2008 11:07:56 -0800 Comment by matthew e I tend to agree that it is probably spam, but I'm surprised that nobody else has mentioned "Confessions of a Gasoline Huffer" as yet. It's the first thing I thought of, though I certainly didn't think huffing gas sounded "tempting" after having read it...

]]> matthew e http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004598 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004598 Mailbag Wed, 23 Apr 2008 11:14:45 -0800 Comment by Abby Damn. My I'm sure incredibly witty comment about why "she" has already gone to hospital got eaten by the spam filter. At least it's somewhat working, right?

]]> Abby http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004602 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004602 Mailbag Wed, 23 Apr 2008 11:18:11 -0800 Comment by JMR When you see a nonsense spam like this, the most likely explanation is that its purpose is to train spam filters, in preparation for more insidious spam down the road.

]]> JMR http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004610 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004610 Mailbag Wed, 23 Apr 2008 11:21:47 -0800 Comment by Colton Thanks a ton @17 - you posted the link the spammers wanted you to visit at their virus-laden site....

]]> Colton http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004626 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004626 Mailbag Wed, 23 Apr 2008 11:32:44 -0800 Comment by NapoleonXIV You're in for it now, Person-Who-May-Be-Named Brendan.

Expect an attack from Ninjas.

Or Pirates.

]]> NapoleonXIV http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004678 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004678 Mailbag Wed, 23 Apr 2008 12:08:58 -0800 Comment by Mahtli69 From: mianga@xxxxxx.net
Date: April 22, 2008 6:58:34 PM PDT
Subject: she has already gone to hospital!…
To: EMAIL ADDRESS


Hello, EMAIL ADDRESS MINUS DOMAIN.

Listen to me carefully, i don’t know what your name is ...

SPAM

]]> Mahtli69 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004690 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004690 Mailbag Wed, 23 Apr 2008 12:22:21 -0800 Comment by Will in Seattle you can inspect the full header using various open source tools, and trace it back to the leased IP block from the third relay server it was forged through.

You still won't find the Chinese spam server that sent it, mind you.

]]> Will in Seattle http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004801 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004801 Mailbag Wed, 23 Apr 2008 13:57:34 -0800 Comment by eggzandspam http://fraudo.com/2008/04/21/she-has-already-gone-to-hospital/

malicious and not delicious SPAM.

]]> eggzandspam http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004842 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004842 Mailbag Wed, 23 Apr 2008 14:43:13 -0800 Comment by Fnarf you can inspect the full header using various open source tools, and trace it back to the leased IP block from the third relay server it was forged through. You're cute when you try to do tech talk, Will. But that's nonsense, every word of it.
There is such a thing as "open source tools", but you don't need them to see the full headers. Virtually all email programs have the ability to show them, including web-based ones. On Comcast's web mailcenter, you click on "View Source" in the email; in Gmail, you click on "Show original" under the little down-arrow next to "Reply".
What you see there won't be the "leased IP block" or "third relay server" it was "forged through" though. Those phrases don't have any meaning.
You will see, among other things, a line beginning "Received: from" which will tell you where the email came from. Note that this is a SERVER, not an email address. And only the part inside square brackets is reliably true. But it won't do you any good; it's probably not going to be a "Chinese spam server", but your neighbor's granny's computer, emailing to you direct. It is impossible to trace it back any further than that.
Aside from the garbled lingo you got wrong, Will, your info is many years out of date. I've spent more time looking at email headers than you have being awake, so it gives me great pleasure to once again award you the "totally full of shit and doesn't know what he's talking about but wants people to think he's savvy" award to .... WILL IN SEATTLE! Congratulations!]]> Fnarf http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004909 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004909 Mailbag Wed, 23 Apr 2008 15:40:44 -0800 Comment by Fnarf Apologies for the ginked paragraphs above.

]]> Fnarf http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004912 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004912 Mailbag Wed, 23 Apr 2008 15:43:55 -0800 Comment by Mab This has been driving me CRAZY since I was emailed it yesterday. If you click on the link/attachment, what shows up?

]]> Mab http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004971 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004971 Mailbag Wed, 23 Apr 2008 16:34:02 -0800 Comment by Fnarf WHY ON EARTH would you click on a link in an email if you didn't know what it was or where it was from? Safe sex, man. Yes, it IS the same thing.

]]> Fnarf http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004975 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1004975 Mailbag Wed, 23 Apr 2008 16:39:56 -0800 Comment by Mab I'm sure someone was stupid enough to open it, and I wanna know what he/she found!

]]> Mab http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1005029 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1005029 Mailbag Wed, 23 Apr 2008 17:47:46 -0800 Comment by Fnarf If it's like most payloads, you wouldn't see a thing, but your computer would immediately start contacting the the mothership (one or another infected PC somewhere) every ten seconds for addresses and more payloads, either spam or virus, and start to work. These networks are self-healing too.

]]> Fnarf http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1005049 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1005049 Mailbag Wed, 23 Apr 2008 18:18:16 -0800 Comment by Enrique It's spam. I've put some details of this on my site, http://fraudo.com/2008/04/21/she-has-already-gone-to-hospital/

Today there's been a lot of interest in this from Canada so I guess it's spreading there atm.

]]> Enrique http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1005090 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1005090 Mailbag Wed, 23 Apr 2008 20:45:24 -0800 Comment by bs @25 who would be dumb enough to click the link? Really.

]]> bs http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1005125 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1005125 Mailbag Thu, 24 Apr 2008 05:49:17 -0800 Comment by Fnarf Well, he's right -- millions of people do. And millions of people buy the crap that's sold in spam.

]]> Fnarf http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1005171 http://slog.thestranger.com/2008/04/spam_or_threat_a_new_game#c1005171 Mailbag Thu, 24 Apr 2008 09:23:46 -0800