Author
Message
addlepated
Unfictologist
Joined: 17 Aug 2003 Posts: 1885 Location: Austin, Texas
[Analysis] Could that email or IM be a trailhead, or SPAM? Here's a centralized thread to post suspicious-seeming emails. If you've gotten something recently and think it could be more than spam, share it here with the Hive Mind and we can help decode or debunk!
Posted: Wed Jan 19, 2005 2:18 am
Last edited by
addlepated on Sun Mar 13, 2005 9:10 pm; edited 1 time in total
paulnevar52
Veteran
Joined: 20 Dec 2004 Posts: 106 Location: zion
Those were my thoughts too. I've recieved several and I think this could be a major trailhead.
_________________HaMWar: First Sergeant FlyingPig reporting for duty.
Posted: Wed Jan 19, 2005 12:59 pm
The Watcher
Unfettered
Joined: 29 Jul 2004 Posts: 493
I'm afraid that this topic will sink to the bottom of the heap and be ignored.
But a good idea, nonetheless.
Posted: Wed Jan 19, 2005 4:49 pm
addlepated
Unfictologist
Joined: 17 Aug 2003 Posts: 1885 Location: Austin, Texas
The Watcher wrote:
I'm afraid that this topic will sink to the bottom of the heap and be ignored.
But a good idea, nonetheless.
Actually, it's a link from the sticky at the top of the forum which reads "Before you post a possible trailhead!".
Posted: Wed Jan 19, 2005 5:53 pm
deBaggio
Boot
Joined: 10 Jan 2005 Posts: 12
anyone care to elaborate on these emails, i've been receiving PLENTY but have deleted for fear of spam-infections! (read as ILL!!)
Posted: Wed Jan 19, 2005 6:01 pm
MageSteff
Pretty talky there aintcha, Talky?
Joined: 06 Jun 2003 Posts: 2716 Location: State of Denial
deBaggio wrote:
anyone care to elaborate on these emails, i've been receiving PLENTY but have deleted for fear of spam-infections! (read as ILL!!)
I've received a few with what appear to be binary codes that don't decode to anything useful. Some may have an interesting looking line that makes you go "Hmmmm..." for a moment just because of the arrangement of words. You have heard of "Spam mimic?" It takes the message you want to hide and makes it look a lot like the "get rich quick" scams that seem to clog inboxes. It makes me a bit leery of tossing anything immediately (well anything except for the Porn and male enlargement ) But I am no good at recognising patterns that might be noticed by others in the results.
_________________Magesteff
A small group of thoughtful people could change the world. Indeed, it's the only thing that ever has. - Margaret Mead
Posted: Thu Jan 20, 2005 3:57 pm
Vid
Veteran
Joined: 07 Aug 2004 Posts: 117 Location: Texas
I just got this email.
Quote:
Greetings,
You are at... The Right Place At The Right Time!
Have you ever wondered why some people have been
in the right place at the right time to take
advantage of opportunities that change their life.
Well...NOW is YOUR chance. All you have to do is
decide whether you want to seize it, or let it pass
you by.
Developed by the worlds industry leaders and
greatest minds with a proven track record.
This is NOT a fly by night game, here today,
gone tomorrow company.
This is a life-changing, once in a lifetime opportunity...
an opportunity I have waited half my life for!
You Will Be Happy To Know....
If you say yes kindly send your info:
==============================================
mailto: bdbest1o3SPLAT yahoo.com
Subject: I need to see it first
First Name:
Last Name
Country:
==============================================
Sincerely,
Vince
bdbest1o3SPLAT yahoo.com
Note: Kindly put Unsubscribe on the subject if you're not interested.
Posted: Fri Feb 11, 2005 4:32 pm
The Watcher
Unfettered
Joined: 29 Jul 2004 Posts: 493
^^^ That's definitely spam. I've gotten several of those before.
Posted: Fri Feb 11, 2005 7:36 pm
Vid
Veteran
Joined: 07 Aug 2004 Posts: 117 Location: Texas
ok thanks
Posted: Sat Feb 12, 2005 9:43 am
Incitatus
Unfettered
Joined: 01 Oct 2004 Posts: 487 Location: Austin, Texas
the only suspisious emial I've had as of late were from piousfleaSPLAT gmail.com
Someone from here most likely who got a hold of some emails and started playing around.
Anywho, my last coorespondance of any merit:
Quote:
revealer >> !analyze revealer transmit proc >> !cmp seeker transmit proc
revealer !behold seeker transmit proc
revealer > net: !extend
revealer > net: !scan "christin gau
behold: "christin gau >> truth
revealer > !transmit "christin gau
I have no clue who christin gau is, perhaps the identity of this seeker?
Still stumped...
_________________"It is unacceptable that chocolate makes you fat."
Posted: Sun Feb 13, 2005 1:39 pm
Duckie
Unfettered
Joined: 17 Oct 2004 Posts: 401 Location: Drifter
Weird Email ::: please move to "[Analysis] Could that e I read over the "could that email be a trailhead?" thread. The one I got passes all the random number tests and all that. It was just weird enough that its nagging me... The account it was sent to was not my normal account, though I have used it for some ARGs. The adress for it is sexless, but whoever wrote it *seems* to have written it in the manner of one writing to a girl.
Quote:
From: "Thicken O. Misguided" <unruliness@avc.lab.kdd.co.jp> [Add to Address Book] [View Source]
To: ***** <******@*****.***>
Subject: Hey honey!
Date: Sat, 12 Feb 2005 08:48:56 +0000
Adieu.
Chao
It seemed like one of those simple messages meant to get past the spam blocker, or the "love notes" you get that are actually viruses... yet nothing was inside other than these words.
The source is strange as well:
Quote:
Received: from 82-45-246-178.cable.ubr06.dals.blueyonder.co.uk ([82.45.246.178])
by sccrmxc18.comcast.net (sccrmxc18) with SMTP
id <20050212084854s1800h2bspe>; Sat, 12 Feb 2005 08:48:56 +0000
X-Originating-IP: [82.45.246.178]
Received: from avc.lab.kdd.co.jp (zen.kddilabs.jp [192.26.91.21])
by 82-45-246-178.cable.ubr06.dals.blueyonder.co.uk with esmtp
id 020370BDD3 for <rascal716@comcast.net>; Sat, 12 Feb 2005 00:48:43 -0800
Message-ID: <100101c510df$d7fc02b9$53e571ff@avc.lab.kdd.co.jp>
From: "Thicken O. Misguided" <unruliness@avc.lab.kdd.co.jp>
To: Rascal <rascal716@comcast.net>
Subject: Hey honey!
Date: Sat, 12 Feb 2005 00:48:43 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0004_A3F5C48A.9FB8EB1F"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2479.0006
X-Virus-Scanned: by Ameriserv.net Anti-Virus E-Gateway
This is a multi-part message in MIME format.
------=_NextPart_000_0004_A3F5C48A.9FB8EB1F
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Do you mind? ))
Kutimuy hatispaqa
------=_NextPart_000_0004_A3F5C48A.9FB8EB1F
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
<META HTTP-EQUIV=3d"Content-Type" CONTENT=3d"text/html;charset=3diso-8859=
-1">
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4=2e0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3d"Content-Type" CONTENT=3d"text/html; charset=3dus-asci=
i">
<META content=3d"MSHTML 6=2e00=2e2800=2e1437" name=3dGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3d#ffffff>
<DIV>
Adieu=2e
<br><IMG
src=3d"http://takayamadas=2einfo/39f07fc29a68f564863be32b8/FAMdMA8LUFNQIg=
08AwQGERJMADYa=2ejpg" alt=3d"underpins" border=3d0>
<br><br>Chao<BR><BR></DIV></BODY></HTML>
------=_NextPart_000_0004_A3F5C48A.9FB8EB1F--
Its bugging me that it seems to be an otherwise pointless email. If its spam, its pretty bad (who other than an ARGer would open email from "Thicken O. Misguided"?
In any case, if its just pointless, feel free to lock this thread, merge it to the "is that email a trailhead" section... whatever.
I just had to get this on here.
I've responded, waiting for another reply.
~Sarah
_________________
ITS A LION! GET IN THE CAR!
Posted: Mon Feb 14, 2005 9:05 pm
Duckie
Unfettered
Joined: 17 Oct 2004 Posts: 401 Location: Drifter
Interestingly, a google pulls up DDRManiaX....
the same place our dear Lenny PM was traced to during the failed "Lenny's Xanga" ARG.
_________________
ITS A LION! GET IN THE CAR!
Posted: Mon Feb 14, 2005 9:08 pm
PlanB
Boot
Joined: 13 Feb 2005 Posts: 40 Location: Little Egypt
Sarah's Odd Email Sarah, I'm pretty sure that the email you listed is indeed some trailhead.
The phrase "Kutimuy hatispaqa" is apparently from Quechua (an Incan dialect in the area know known as Peru) and means roughly "Respond if you can" or "Return if you are able". It was a standard goodbye, it seems in that language, but hardly seems the sort of phrase a spammer would use. I suspect you've got a live one here...
Posted: Mon Feb 14, 2005 9:49 pm
SarahKiddo
Guest
For clarification: The google search that pulled up DDR was from the name christin gau.
Posted: Tue Feb 15, 2005 6:18 am
strife777
Guest
As an FYI, all the Chicken P. McStinksalot (or similiar) emails ARE spam, and email address harvesters. They are short, and non-sensical to attempt to pass any spam filters you might have, and when they don't get back a Daemon error that the address doesn't exist, they add it to a list that they sell to real spammers. So it is not a trailhead at all, its just a phishing attempt for live email addresses.
Posted: Tue Feb 15, 2005 9:28 am
Display posts from previous: All Posts 1 Day 1 Week 2 Weeks 1 Month 3 Months 6 Months 1 Year Sort by: Post Time Post Subject Author Ascending Descending