Slashdot Mirror
Some Spammer Has a Crush on You
A friend of mine and I were bit by SomeoneLikesYou in the last week. The scam is elegant in its simplicity. The site teases you with an email claiming to know someone who likes you, then makes you guess who it might be by submitting their email address(es). Each of those addresses receives a teaser email just like yours. Rinse, repeat. I ignored the message -- obviously a fake; I couldn't possibly be anyone's crush :-) -- but my friend took the bait and fed it some demographic data and email addresses. Once she realized what was going on, she wrote to everyone apologizing for any spam they may have received. She also sent a nastygram to the site's operators.
It should be pointed out that there is no proof that SomeoneLikesYou is doing anything nefarious with the data they're collecting. However, their credibility is not strengthened by their faked WHOIS records and their meaningless doubletalk on privacy issues (the declaration, "We send precisely zero e-mail advertisements," says nothing about the behavior of their partners/affiliates.)"
I sent in my money and all she sent me was spam. And here I thought she was going to send me a nude pic and hours of hardcore action.
Karma whorin' since 1999
I have an e-mail address that I have used to register for exactly one thing: AOL Instant messenger. I've never sent any other e-mail through this account, I've never published the address on the internet, or anywhere else for that matter. Yet apparently someone who has a crush on me has managed to get that e-mail address and report it to Crushlink! I don't even want to log on to the site to get onto their opt-out list because I don't trust them enough not to sell my address once they have verified that there is an actual person behind it.
Argh, I hate spam.
This is obviously a plot... who the hell in their right mind would have a crush on me?!?!
SOME GIRL: I know somebody who's got a crush on you
:-D
ME: Oh yeah? Who?
SOME GIRL: Will you pay me if I let you have a guess?
ME: I don't care, I'm rich, there you go. Is it SHE?
SOME GIRL: No. Nice try, though.
[later...]
SOME GIRL: Hey OTHER GIRL, I know somebody who likes you
SHE: Oh yeah? Who?
SOME GIRL: Will you pay me if I let you have a guess?
SHE: There you go. Is it stere0?
(note: I didn't have facial hair in primary school)
SOME GIRL: No.
I overheard them, and this is how SOME GIRL got rich by doing this to the whole school and how I got my first kiss a couple of weeks later.
Trollem mirabilem hanc subnotationis exigiutas non caperet
funny, some weeks ago I received a SMS on my mobile with the same content, telling me: Someone who is too shy has a crush on you.
To find out dial: 0190-whatever
0190 is in Germany the dialing prefix for Premium rate-services (from 1 to 10 euros/minute)
I didn't call but looked in the newsgroups if someone has: works exactly the same way you described:
- please give us some mobile numbers from persons you guess that might be it..
There really is someone who likes you. In fact, here's the original personal ad involved:
"Mass email marketer ISO young, wealthy singles with low self-esteem and money to burn. Low IQ is a plus, gullibility even better. Turn-ons: making telephone calls at dinnertime, taking long walks on the beach with your money."
What's your damage, Heather?
My numbers come from here.
$100 gets 10 million addresses. It costs $3,000 to send these 10 million messages. Let's assume a capital outlay of $3,100 per week, which seems reasonable.
A "positive response rate" of 0.1% to 1% is expected. Say 0.1%, since this scam is especially egregious, that's 10,000 responses per week, is 10,000 suckers per 60 * 24 * 7 = 10,080 minutes.
That means a sucker is born every minute (every 59.52 seconds, actually), which we already knew.
The good and new comes from no quarter where it is looked for, and is always something different from what is expected.
You can't do that for this service. Your *friends* give them your email address. I'd like to find out which of my "friends" gave my personal email address to crushlink.com (a similar service) and beat them. However it looks like the only way I can find out is by entering the email addresses of all my friends so they all get spammed.
At the bottom, it adds "The call is charged as a long distance call - For UK the charge is 2.5 Pence/sec" which is £1.50 per minute. Even then, I don't think that's enough to cover them legally, as I beleive they have to state the cost as a per-minute rate.
Fortunately, I'm not stupid enough to believe that these messages are for me. No-one I know sends messages in bright yellow with red and blue headings.
Just remember how UK phone charges work:
01/02 - standard long distance geographic number. Basically cheap.
05 - I don't think this is used, except 0500 which is free
07 - mobile, going to be quite expensive
08 - information. Generally increasing in cost as number increases, except for 0845 charged as local
09 - premium rate. Cost determined by operator, without limit.
00 - international. Again expensive.
If you don't know what the number is, don't dial!
Noone really has a crush on the support alias for my company? I don't know how I'm going to break the news to it.
A couple of weeks ago I received a SMS message that started with "Iemand vindt je leuk, en heeft ons jouw nummer achtergelaten..." ("Someone likes you and has left your number with us", original Dutch maintained for Google searches).
Oh, speaking of googling, there was a hilarious spelling mistake at the end "Wil je weten wie je geheime *aanbieder* is?" ("Do you want to know who your secret admirer is", except they put an 'e' in "aanbidder" where a 'd' should be, "aanbieder" means "provider")
I couldn't find a reference on the internet to this operation, so I figured it might be legit. I called to the number they gave: 09062001372 (couple dozen eurocents a minute). They pulled the same routine as described above. I had to enter my own phone number (as if they didn't have it) then take a guess as to who left my number in the first place (I gave a bogus number). Then I was promised they'd SMS the number of my secret provider, but of course they never did.
I suppose this scam pays off quite well. I'm a pretty suspicious person as a rule, but in this case, especially after I couldn't find any information about it on the internet, I just had to check it out. They got about 3 minutes worth of high phone rates out of me.
I've tried Spamgourmet. Excellent free service where you can do this:
:-)
1. Register a username like "foo".
2. Register at the MegaSpam forum.
3. Tell them your e-mail address is megaspam.2.foo@spamgourmet.com.
4. You will be forwarded the next 2 mails from the MegaSpam forum, probably containing password details as such things.
5. Spamgourmet will then eat all mails from the MegaSpam forum.
They also allow you to list trusted senders, which don't advance the message count for your temporary address, reply address masking, and password prefixes so others can't make up new addresses with your username.
Pretty nice, especially as it's free and no ads or other catches. They have around 14,000 accounts as of today and eats about 12,000 spams/day.
And there's also despammed.org where any mails to that address will be filtered from spam before it's sent to your primary address or the web service. Everything on that site is free (and ad free) as well.
Beware: In C++, your friends can see your privates!
I got these stupid e-mails too, but they wouldn't release the address of your so-called crush until you furnish them with e-mail address after e-mail address.
Instead of putting down bogus addresses, I submitted every abuse@{$insert ISP here} address and anti-spam address that I could think of. That'll give them something to think about.
Where does the school board find them and why do they keep sending them to ME?
EDU domains tend to scare spammers.. not only is there not much money to be got. They are likely to end up with some anti spam vigalante with a lot of free time that can be spent causing them pain.
So when my address was spammed by SomeoneLikesYou, I got on the phone. Sure enough, the one person who actually did it was my not-so-security-minded girlfriend.
So when I hit the site, I entered only one email address--hers. The site didn't like that, and since it doesn't like bounces either, I just started registering aliases on my linux box. So we had a@mybox.net, b@mybox.net, c@mybox.net, and d@mybox.net.
And, sure enough, when it finally accepted that, it said I had a match! (I also had some 4 more emails popping up in my inbox....)
Since the site demanded that I pay up-front or sign up for affiliate info, I went on my merry way, happy to know I hadn't offended anyone else.
About a month later, though, I got this email "Are you sure this loser Sara is right for you?" which told me to come back and visit the site again, threatening to remove my information and promising not to spam me again. I received a second mesage, again titled "Are you sure this loser Sara is right for you?", before I created a new procmail rule.
I figured I was lucky, I got everything I wanted to know without it costing me anything but the time. I doubt many others were so lucky.
Never sign up anywhere with a real email address. /dev/null, and you never hear about them again.
Instead, get an account on Spamgourmet, and you'll have as many disposable email addresses as necessary, that will work only as many times as you want. Then they become a direct link to
Seriously. This service rocks.
-- B.
This sig does in fact not have the property it claims not to have.
I've been onto their particular game for about half a year now, as evidenced in a warning I wrote here.
In general, you should never give anyone's email address out. Ie, treat it like a phone number; it's not yours to give out, it's the owner's.
I treat the 'send this to a friend' thing in the same way. If you read the privacy statements of a lot of web sites, you'll see that it refers to your privacy, but doesn't mention anything about the privacy of your friends' email addresses that you happen to type into those 'send this to a friend' boxes.
- you have a job that requires that you post on public, technical mailing lists.
- you have a job where your email address ends up in whois records.
- you're the postmaster, hostmaster or any other sort of contact for a company.
- you don't need your email address to be publicly available for business reasons.
- somebody forwards an email that you sent them to a public mailing list.
- you've had the same, well-known email address since the days when it was considered a good thing to publicize your address.
- one of your friends or business associates gets a virus that causes your email address to end up getting sent off to a mailing list or something.
- your dipshit ISP allows VRFY.
- etc, etc, etc.
There's not always an easy way to keep from getting spam, even if you're relatively careful with your addresses.