Film-Tech Forum ARCHIVE: Fake E-Mail Sender Names

This is topic Fake E-Mail Sender Names in forum Film-Yak at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=8;t=003534

Posted by Mark Lensenmayer (Member # 134) on 09-03-2004, 05:19 PM:

I'm sure most of you have gotten fake e-mail from Johnny, Tim, Jenny, Cathy T or names like that. They look like you just might know someone by that name, so you'll open the unwanted ad. But lately the names have been getting more and more absurd. Just today, I received an e-mail from Nineteenths T. Formula. But my very favorite just came in. I'm thinking of adopting is as my official pseudonym (handle):

Centrifuges R. Photocopy .

Has anyone found a name that can top that one?

BTW, this e-mail traces back to domains registered to Easylink Services Company, a company that sells anti-spam software. The address headers could be forged, however.

[ 09-04-2004, 07:18 AM: Message edited by: Mark Lensenmayer ]

Posted by Bobby Henderson (Member # 840) on 09-03-2004, 05:57 PM:

Yeah, there's lots of faked names. And I think there's even more legit names that get spoofed. I often get Mailer Daemon "return to sender" notices from spammers that have spoofed one of my mailbox addresses. All it takes is for your address to be resident in any Outlook Express user's contact list, if even that. Lots of malware and most spam gets spread in this fashion.

I read most of my e-mail in plain text only. What I don't understand is garbage like this is spam notes:

quote:
upheaval tub neumann tempo plato sprague elisha embark teethe axiomatic adelaide becker bracelet prospect wisenheimer fireplace simpleton vitrify imprimatur gentlemen shake lusty shopworn roomful myron wastage confocal suckling bullyboy newsboy risky persist euclid transgressor whitehead attach waterway audio

What the hell is that stuff?

Posted by Jon Miller (Member # 163) on 09-03-2004, 07:03 PM:

Bobby, that stuff is designed to fool Bayesian filters into thinking there is legitimate content and, thus, prevent the filtration of the spam message into a junk-mail folder. Filters are wising up to that tactic...just about the only spammer technique that has a high potential of beating filters nowadays is the inclusion of a paragraph in the form of a news release in the message.

Spammers= [bs]

Posted by Daryl C. W. O'Shea (Member # 1303) on 09-03-2004, 08:55 PM:

I saw that name a couple months ago while writing some code and working with my spam corpus, I may still be receiving spam with the same name, who knows.

As for tracing back to Easylink, is it really from their system or is it forged. Lots of UCE SMTP engines include the 'ability' of starting the message off with a few forged headers before passing it off to another mail exchanger.

As for Bayesian filters and such, if you combine them with other methods, such as SURBL and SpamAssassin, you're going to elimiate almost all of your spam, even if you include some legitimate looking text with the message to try and throw things off.

Posted by Mark Lensenmayer (Member # 134) on 09-04-2004, 07:17 AM:

Today I got one from Vanquish K. Silkworm.

As for tracing to Easylink, the e-mail was sent from one domain (artlover.com) with reference to another (witty.com). I did a WHOIS on both domains and they are registered to Easylink. Daryl, you are correct that this is not total evidence that the message came through Easylink. I have edited the original post to reflect this.

Posted by Jon Miller (Member # 163) on 09-05-2004, 10:06 AM:

Alotta Pee.

Since the subject was, uh, "highly questionable" (somehing about gushers and not about oil wells [Wink]

) , I deleted the message on the spot and didn't think to check its origins.

Posted by Gary Crawford (Member # 2038) on 09-06-2004, 12:53 AM:

I get a bunch of "return to senders". My question is just how many spams are going out with my email addy as source? No way to know I imagine, but they are going out.

Posted by Mark Lensenmayer (Member # 134) on 09-12-2004, 09:24 PM:

Here's some new ones:

Mariano Kubota (Kubota makes some excellent tractors.)
Uplands J. Normalization
Wastepaper H. Bentley
Lens B. Longhand
Combustibles F. Breaker
Weary R. Bypasses

Do people actually open these?

Posted by Daryl C. W. O'Shea (Member # 1303) on 09-12-2004, 09:28 PM:

Posted early this morning to users@spamassassin.apache.org

quote: http://issues.apache.org/...&msgNo=15673

Response to: Medicine sites (Predrag Lezaic)

From: jdow <jdow@earthlink.net>
Subject: Medicine sites
Date: Sat, 11 Sep 2004 23:30:06 -0700
Content-Type: text/plain;
charset="iso-8859-1"

<non-poco alert>
Please do remember that at half the population has an IQ below 100.
Please also note that most denizens of this list probably fall into
the above 120 to below infinity crowd. Note also that this does not
mean they can't get it. It just means there is a serious time lag in
their thinking processes that may lead to them acting before the
thinking process completes. This often leads to tragic results. Be
thankful that they exist. They are well suited to perform jobs that
would drive most of us utterly starkers within 1 hour. They also provide
a handy market for old "Gilligan's Island" tapes.

And now that I've let my wretched sense of humor run excess I'll go
bang my head against my cell's padded wall in penance.

{^_^}
----- Original Message -----
From: "Predrag Lezaic" <plezaic@lutefisktechnologies.com>

> Are there really people that will buy their medicine from a site with
> name like this? http://oaktjtxa.efkdblh.info
>
> Predrag
>
> >