Hello, gentle readers. It has been some time since I last skewered some spam for your reading enjoyment. Things have been busy, and quite frankly nothing new and interesting has come along (which is, alas, all to often the case with spam.) HOWEVER: I did get a new piece in my Inbox recently which I thought I would share with you. It is deliciously ironic, on several levels, and provides me the opportunity to not only ridicule the spammer for wasting my time and bandwidth by sending this crap out, but also for being a complete, total, and utter Fool to boot.

So, Without Further Ado: The Spam!

Return-Path:
Received: from psmtp.com (exprod5mx6.psmtp.com [64.75.1.146])
by (8.10.2/8.10.2) with SMTP id g7G0x9a21528
for <>; Thu, 15 Aug 2002 19:59:09 -0500
Received: from source ([68.6.19.242]) by exprod5mx6.postini.com ([64.75.1.251]) with SMTP;
Thu, 15 Aug 2002 17:59:11 PDT
Received: from vcus.net ([68.5.27.40]) by fed1mtao03.cox.net
(InterMail vM.5.01.04.05 -20011231) with ESMTP
id <20020816005901.LCJW1390.fed1mtao03.cox.net @ vcus.net>
for <>; Thu, 15 Aug 2002 20:59:01 -0400
From: ''''
To: ''' <>
Subject: YOU HAVE TO TRY THIS! IT REALLY WORKS!!
Date: Thu, 15 Aug 02 17:25:52 Pacific Daylight Time
MIME-Version: 1.0
Content-Type: multipart/mixed;boundary= ''----=_NextPart_000_001F_AED66BB5.CE75AA8A''
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 0
X-MimeOLE: Produced By Microsoft MimeOLE V0
Message-Id: <20020816005901.LCJW1390.fed1mtao03.cox.net @ vcus.net>
X-pstn-addresses: from forward (good recip)

So, on to the analysis. The first thing you should notice is that I didn't include the payload (message content), only the headers. The reason for that will become apparent shortly.

The first ''Received:'' line shows the message being sent to my ISP from a company called Postini, which provides a spam-filtering service my ISP uses. They actually do a pretty good job of minimizing the amount of spam in my Inbox.

The second ''Received:'' line indicates that Postini received the mail from a machine with the internal name of 'source' at IP 68.6.19.242. The third ''Received:'' line shows the email being received by 'fed1mtao03.cox.net' (68.6.19.242) from 'vcus.net' at IP address 68.5.27.40, which resolves to 'ip68-5-.oc.oc.cox.net'. So, we have a complete, unbroken chain.

Now, on to the payload. When I read the message, it turned out to be a variant of the ''AS SEEN ON NATIONAL TV!'' 5-reports MMF chain letter. Certainly, I thought, the fine folks at Postini should have caught this. Then, I looked at the actual source for the email, and found out why it got through: the message content was Base64-encoded. This encoding scheme, defined as a MIME (Multipart Internet Mail Extension) type in RFC1521, provides a mechanism for enhancing the privacy of an email message by converting the text to a format that is not (easily) humanly readable. In layman's terms, the message was converted to a form of ciphertext to thwart people with network sniffers from reading the data in transit. In this case, it was done to bypass spam and other content-filtering systems.

Of course, my email client can decode it just fine, so I have the text of the message available. In the interest of not boring you, I won't reprint the entire thing, though if you want to read it you can by simply clicking here. Instead, I will let you see the first couple of paragraphs, and the List of Phoolz!

Hi

Hi.

I hope it is ok that I send you this. If you are not interested, simply delete. However, print it out and read it then read it again.

Actually, no it isn't. OK to send me this, that is. And, if I am not interested, and simply delete it, how can I then print it out and read it then read it again? And, why do I need to read it then read it again? It simply reading it not good enough? Can I read it without having to print it out, or read it again? My, this is confusing.

This really does work. Within 2 weeks the orders (money) will start coming in just as the plan said it would. Give it a try! You'll be glad you did!

Somehow, I don't think so. Just call it a hunch.

Thanks and Good Luck!

Jill Goodson

Thanks to faster computers and a more fluid Internet, you could earn over a half million dollars every 4 to 5 months from your home! Before you say ''bull'', please read the following: This is the letter you may have recently seen in the news.

Where would I have seen this in the news? And, when did we get a ''more fluid internet''? And, how did it become more fluid? Is it because of spews like this you are ''flooding'' the Internet with?

Due to the growing popularity of this system on the internet, a national weekly news program recently devoted an entire show to the investigation of this grogram. The show also investigated the legality of the program. Their finding proved that there are absolutely no laws prohibiting the participation in this program, and if people follow simple instructions, they are bound to make serious money with only $25 out of pocket cost.

Ok, I have waited long enough. Can I say ''bull'' now?

As this program gains popularity and attains respect, it works better than it ever has.

Ok, I am going to say it now. ''Bull''. There, I said it.

Yep, it is an MMF chain letter, sure enough. The fake ''testimonials'', the promises that you can Make $$$$MONEY$$$$$ Fast!, lots of statements IN ALL CAPS with LOTS OF EXCLAMATION POINTS!!!!!!!!!, the assurances it is 1000% LEAGEL BUSINESS OPPORTUNITY!, exhortations to FOLLOW THE PROGRAM EXACTLY, yada yada yada. Looking down the letter, we come to the List of Phoolz.

PLACE YOUR ORDERS FOR THESE REPORTS NOW!

REPORT #1: ''The Insider's Guide to Advertising for Free on the Net''

Order REPORT #1 from:

Jill Goodson
22605 La Palma Ave. #502
Yorba Linda, CA 92887
USA

REPORT #2: ''The Insider's Guide to Sending Bulk e-mail on the Net''

Janet Hulsizer
580 Harrison St.
Titusville, FL 32780
USA

REPORT #3: ''Secret To Multilevel Marketing on the Net''

Amanda Barnett
3295 Sandhurst Dr.
Zanesville, OH 43701
USA

REPORT #4: ''How to Become A Millionaire Utilizing MLM & the Net''

Jackie Sissel
5856 Redwood Rd.
Plymouth, IN 46563
USA

REPORT #5: ''How to Send Out One Million E-mails Free''

Charlotte Dailey
1917 Wood St.
Texarkana, TX 75501
USA

Well, at least it appears that our MMFool can follow simple directions. The Phool behind REPORT #1 is in fact one ''Jill Goodson'', which matches the sender of the email. Hmmm, this is interesting. Looking up the address ''22605 La Palma Ave.'' in Yorba Linda returns a lot of BUSINESS and CHURCH listings. It appears that this may be a business park, in which case maybe Ms Goodson is running this scam scheme from her office, using her employers' equipment and Internet connection. Further attempts to identify just who occupies Suite 502 were fruitless, but if anyone just happens to know this information, please and I'll be glad to print it here.

One last quote from the email:

If you have any questions of the legality of this marketing program, contact the
Office of Associate Director for Marketing Practices
Federal Trade Commission
Bureau of Consumer Protection, Washington D.C.

Yep, that's where I have seen this letter in the news. Want to see for yourself? Simply click right here. Of course, if you are thinking to yourself ''Surely, Ms. Goodson must be telling the truth here'', you are going to be in for a disappointment, I fear.

Before I go, I have one last point to clear up. I promised you a helping of irony with this spam. Well, let it not be said I can't deliver on what I promise. There is a site called The MMF Hall of Humiliation, which is dedicated to ridiculing those who perpetuate MMF chain letters. The site has its own domain, ''mmfhoh.org''. And who, might you ask, is the registered owner of the ''mmfhoh.org'' domain? Yep, it's none other than li'l ol' me.

Have a nice day!

Update, Aug 17: It seems that Jill was quite serious about the fact that I should Read This then READ IT AGAIN!!! For, this morning I received a SECOND COPY of the MMF email. Don't believe me? You can see it for yourself, by clicking here. It also appears that she is using some kind of spam-bot that harvests email addresses off of web sites, for she sent this particular copy to my ''webmaster@'' address. That's right, she is sending invitations to commit fraud out blindly.

I wonder what would happen if I somehow managed to include the email address on one of my web pages - this one, for example?

je je je je je :)

Anyway, I hope that while her spam-bot is crawling my site, harvesting email addresses, she takes some time and actually reads the site, and stumbles across this article.

But, I suspect that is too much to hope for, isn't it?