Opinion

Felix Salmon

Spam mystery solved!

Felix Salmon
Aug 4, 2009 16:15 UTC

I asked; Spamhaus has answered.

The purpose of the spam is to trick recipients into responding to answer the questions. The questions and their responses are actually a system of gathering data to compile a series of “Answer your questions” websites run by “X Media Partners” which generate revenue from Google adverts placed alongside the answers…

The main person behind this spam operation appears to be a Canadian named “Doug Collins” who also goes as “Ryan Collins” and “Amanda Collins”, of 30 Gooderham Dr., Georgetown, ON L7G5R6, CA.

When Spamhaus investigated these ‘random question’ spams, we found that in each case the identical questions were used by the websites above and the answers sent back by recipients who had fallen for the spams were also on these same websites. To verify this, Spamhaus answered one spam from “winstonfinancial@gmail.com” which asked “How to pack teenagers for europe?”. Our answer, word-for-word including intentional mispellings appeared as if by magic a few minutes later on the website www.goftp.com.

Clever! I wonder whether “Doug Collins” will suffer at all for this. Somehow I doubt it.

COMMENT

Skype is a channel too, and it was even (poorly) translated into my obscure little language.

What weird spam is this?

Felix Salmon
Jul 23, 2009 13:13 UTC

On June 11, I got an email from mike.power200@gmail.com:

Hi,
What are the tax if i live in ny and la?
Would you consider giving me a hand or at least some advice based on your experience?
Would you consider giving me a couple pointers?
Thank you in advance.
Sincerely,
Larry

It was the first of many such weird, semi-targeted spams. June 22, from petrov.gazprom@gmail.com:

Hi,
How much rent you can play on a 6 million house? What are the pros and cons I should be looking out for? Would you consider giving me a couple pointers? I really appreciate your help. Thankyou, Jerod

June 27, from winstonfinancial@gmail.com:

How much per square foot to build an apartment? I have been thinking about this for a while and was hoping you might be able to shed some light on the subject. Please point me in the right direction. Thank you for your help.
Thanks,
Jerod

July 1, from the same winstonfinancial address, but this time with a different name at the bottom:

Hello,
Are interest rates on cds going to go up? What Gotchas should I be aware of?
Please point me in the right direction.
Thankyou. Gratefully, John

On July 5, an email from petersons.production@gmail.com dispensed with the greeting entirely:

When are mortgages going back to normal?
I need a little help/direction before I can start. Any nuggets of wisdom would be absolutely great and very much appreciated. Would you consider giving me a couple pointers? Thank you very much. Warmest Regards, Terry

On July 10, the same email address asked me about fixed vs variable mortgages, signing itself “Susan”; on July 15, it was “Frank” looking to rent a house in the UK; and on July 19, the email had changed to petrov.gazprom@gmail.com, where “Tony” wanted to know “How much does it cost per day in london?”. By July 21, “Tony” had changed his email to iris.accountants@gmail.com, maybe because the petrov.gazprom address had switched over to “Leanne”, who, this morning, asked me “How much does 1 hour phone cost on the home phone?”.

The general rubric is clear: a foo.bar@gmail.com email address, a question, a plea for help, and a sign-off. Is anybody else getting these emails? And what is their purpose?

COMMENT

Joan mentioned earlier they used the words “Kind regards” I have been getting emails from a Nigerian scam where they want to order large quantities of goods and have them sent to a orphanage in Nigeria. The problem with this it is a scam. There is usually poor English, one word missing and often use the words “kind regards” or kindly. They always want to know what kind of payment you require. In other words do you take credit cards. They pay with stolen credit cards. Somehow this scam leaves you holding the bag with their freight stuck and held for randsom in a container. I think this is some how connected. Simply because of the language and the oddity. I think I will open a new G-Mail account and eventally close the old one for security purposes & get Lifelock!!!

  •