Film-Tech Forum ARCHIVE: Fake E-Mail Sender Names

my profile | my password | search | faq & rules | forum home

»	Film-Tech Forum ARCHIVE » Community » Film-Yak » Fake E-Mail Sender Names

Author

Topic: Fake E-Mail Sender Names

Mark Lensenmayer
Phenomenal Film Handler

Posts: 1605
From: Upper Arlington, OH
Registered: Sep 1999

posted 09-03-2004 05:19 PM

I'm sure most of you have gotten fake e-mail from Johnny, Tim, Jenny, Cathy T or names like that. They look like you just might know someone by that name, so you'll open the unwanted ad. But lately the names have been getting more and more absurd. Just today, I received an e-mail from Nineteenths T. Formula. But my very favorite just came in. I'm thinking of adopting is as my official pseudonym (handle):

Centrifuges R. Photocopy .

Has anyone found a name that can top that one?

BTW, this e-mail traces back to domains registered to Easylink Services Company, a company that sells anti-spam software. The address headers could be forged, however.

[ 09-04-2004, 07:18 AM: Message edited by: Mark Lensenmayer ]

| IP: Logged

Bobby Henderson
"Ask me about Trajan."

Posts: 10973
From: Lawton, OK, USA
Registered: Apr 2001

posted 09-03-2004 05:57 PM

Yeah, there's lots of faked names. And I think there's even more legit names that get spoofed. I often get Mailer Daemon "return to sender" notices from spammers that have spoofed one of my mailbox addresses. All it takes is for your address to be resident in any Outlook Express user's contact list, if even that. Lots of malware and most spam gets spread in this fashion.

I read most of my e-mail in plain text only. What I don't understand is garbage like this is spam notes:

quote:
upheaval tub neumann tempo plato sprague elisha embark teethe axiomatic adelaide becker bracelet prospect wisenheimer fireplace simpleton vitrify imprimatur gentlemen shake lusty shopworn roomful myron wastage confocal suckling bullyboy newsboy risky persist euclid transgressor whitehead attach waterway audio

What the hell is that stuff?

| IP: Logged

Jon Miller
Jedi Master Film Handler

Posts: 973
From: San Diego, CA, USA
Registered: Sep 1999

posted 09-03-2004 07:03 PM

Bobby, that stuff is designed to fool Bayesian filters into thinking there is legitimate content and, thus, prevent the filtration of the spam message into a junk-mail folder. Filters are wising up to that tactic...just about the only spammer technique that has a high potential of beating filters nowadays is the inclusion of a paragraph in the form of a news release in the message.

Spammers= [bs]

| IP: Logged

Daryl C. W. O'Shea
Film God

Posts: 3977
From: Midland Ontario Canada (where Panavision & IMAX lenses come from)
Registered: Jun 2002

posted 09-03-2004 08:55 PM

I saw that name a couple months ago while writing some code and working with my spam corpus, I may still be receiving spam with the same name, who knows.

As for tracing back to Easylink, is it really from their system or is it forged. Lots of UCE SMTP engines include the 'ability' of starting the message off with a few forged headers before passing it off to another mail exchanger.

As for Bayesian filters and such, if you combine them with other methods, such as SURBL and SpamAssassin, you're going to elimiate almost all of your spam, even if you include some legitimate looking text with the message to try and throw things off.

| IP: Logged

Mark Lensenmayer
Phenomenal Film Handler

Posts: 1605
From: Upper Arlington, OH
Registered: Sep 1999

posted 09-04-2004 07:17 AM

Today I got one from Vanquish K. Silkworm.

As for tracing to Easylink, the e-mail was sent from one domain (artlover.com) with reference to another (witty.com). I did a WHOIS on both domains and they are registered to Easylink. Daryl, you are correct that this is not total evidence that the message came through Easylink. I have edited the original post to reflect this.

| IP: Logged

Jon Miller
Jedi Master Film Handler

Posts: 973
From: San Diego, CA, USA
Registered: Sep 1999

posted 09-05-2004 10:06 AM

Alotta Pee.

Since the subject was, uh, "highly questionable" (somehing about gushers and not about oil wells [Wink]

) , I deleted the message on the spot and didn't think to check its origins.

| IP: Logged

Gary Crawford
Expert Film Handler

Posts: 200
From: Neptune NJ USA
Registered: Nov 2003

posted 09-06-2004 12:53 AM

I get a bunch of "return to senders". My question is just how many spams are going out with my email addy as source? No way to know I imagine, but they are going out.

| IP: Logged

Mark Lensenmayer
Phenomenal Film Handler

Posts: 1605
From: Upper Arlington, OH
Registered: Sep 1999

posted 09-12-2004 09:24 PM

Here's some new ones:

Mariano Kubota (Kubota makes some excellent tractors.)
Uplands J. Normalization
Wastepaper H. Bentley
Lens B. Longhand
Combustibles F. Breaker
Weary R. Bypasses

Do people actually open these?

| IP: Logged

Daryl C. W. O'Shea
Film God

Posts: 3977
From: Midland Ontario Canada (where Panavision & IMAX lenses come from)
Registered: Jun 2002

posted 09-12-2004 09:28 PM

Posted early this morning to users@spamassassin.apache.org

quote: http://issues.apache.org/...&msgNo=15673

Response to: Medicine sites (Predrag Lezaic)

From: jdow <jdow@earthlink.net>
Subject: Medicine sites
Date: Sat, 11 Sep 2004 23:30:06 -0700
Content-Type: text/plain;
charset="iso-8859-1"

<non-poco alert>
Please do remember that at half the population has an IQ below 100.
Please also note that most denizens of this list probably fall into
the above 120 to below infinity crowd. Note also that this does not
mean they can't get it. It just means there is a serious time lag in
their thinking processes that may lead to them acting before the
thinking process completes. This often leads to tragic results. Be
thankful that they exist. They are well suited to perform jobs that
would drive most of us utterly starkers within 1 hour. They also provide
a handy market for old "Gilligan's Island" tapes.

And now that I've let my wretched sense of humor run excess I'll go
bang my head against my cell's padded wall in penance.

{^_^}
----- Original Message -----
From: "Predrag Lezaic" <plezaic@lutefisktechnologies.com>

> Are there really people that will buy their medicine from a site with
> name like this? http://oaktjtxa.efkdblh.info
>
> Predrag
>
> >

| IP: Logged

All times are Central (GMT -6:00)

Printer-friendly view of this topic

The Film-Tech Forums are designed for various members related to the cinema industry to express their opinions, viewpoints and testimonials on various products, services and events based upon speculation, personal knowledge and factual information through use, therefore all views represented here allow no liability upon the publishers of this web site and the owners of said views assume no liability for any ill will resulting from these postings. The posts made here are for educational as well as entertainment purposes and as such anyone viewing this portion of the website must accept these views as statements of the author of that opinion and agrees to release the authors from any and all liability.