The time travel spammer has a name

Tonight I received another DWG needed mail. It’s pretty much the same as the last one except the coordinates has changed somewhat to a positive value for longitude: Latitude N 42.47935 & Longitude W 071.17355 Elevation 119. The new pickup time is for today (”Monday August 4th at (exactly 3:00pm) Eastern Standard Time”). If someone is close. You could have some fun meeting up.

Latest Time Travel Spammer updates

I’ve been away from it all for a few days, and have received lots of feedback on entries on the Time Traveller spam mails. I decided to publish them all. Some with comments, others as is. It’s all pretty unsorted. But it’s all here! (All email addresses are removed.)

 

Sean has a photo of the Time Traveller?

I can’t believe I missed this one! In his latest DWG spam mail, the time traveller sent us a position for dropping off the DWG unit, the GRC79 induction motor, the four I80200 warp stabilizers with 512GB of SRAM and the menu driven GUI with front panel XID display. Sean Sosik-Hamor actually went there and saw someone that could be time traveller Bob trying to do the Dimensional Warp Generator pickup! He even took a photo of someone that can be him!

From: Sean Sosik-Hamor

Date: mån jul 28, 2003 23:23:29 Europe/Stockholm

Subject: People were at the Warp Generator pickup point today…

Don’t know if you’ve received the latest Warp Generator spam, but the teleportation pickup was supposed to go down today at 3:00 PM. People were actually all over the drop site. I have pics…quite funny!

http://www.inertramblings.com/archives/000247.html

http://www.inertramblings.com/archives/000250.html

Figured you’d find it interesting since you covered the story before…

/Sean/

Than’s for that Sean! I did get the pickup mail. It’s just great to see that you could cover it!

———-

 

 

Bob White == Robert Todino?

Tom Hinds sent me this mail where we get a real name for Time Traveller Bob.

From: ”Tom Hinds”

Date: mån jul 28, 2003 08:21:49 Europe/Stockholm

Subject: more on the time traveler

I received the time travel spam today and got curious, so I searched the Web. Your site came up. I also learned that the time traveler’s real name is Robert Todino (see this Web site

http://www.smooshspace.com/weblog/archive/000284.html).

I’m sure he is a genuine schizophrenic or some such, but he’s tried to raise the funding for his time travel using his spam software in more conventional ways. Go to this Web site and find ”Robert Todino” for more:

http://www.studio42.com/…deadbeats05.shtml

tom hinds

USA

Robert Todino works quite well with Bob White so this might actually be correct! And if it chances are quite big that it’s the Robert Todino who we can read about at

http://www.ago.state.ma.us/txt/rtmarket.htm

Or is Woburn overpopulated by spammers named Robert or Bob?

Also see this Google search for Robert Todino

———-

 

 

The Toshiba GRC79 is a fridge!

Now that we know that Time Traveller Bob has a lengthy experience in the spamming business, the next mail, from Kevin Holmes is in place. Why do these spam messages slip through our junk filters? Kevin also found that the GRC79 is a Toshiba refridgerator…

From: ”Kevin Holmes”

Date: mån aug 4, 2003 10:18:12 Europe/Stockholm

Subject: time travel email

I have a good idea why they’re using old-school methods, rather than HTML mail. My web server has Spamassassin to filter out the spam. After about a year of use, we’ve got it fine tuned to where 99.99% of the spam gets caught, and 99.99% of the good mail makes it through.

This particular email didn’t score enough hits to get caught as spam:

X-Spam-Status: No, hits=4.1 required=5.0

tests=

MISSING_MIMEOLE

MISSING_OUTLOOK_NAME

NO_REAL_NAME

Most of my spam comes through EASILY as a 6+. This one slipped through because there were, in fact, no pictures, html, or ”click here to help me out” links to be seen a elements of a spam email. I’d be VERY interested to know where the coordinates of this lead… and if there is actually an office there to receive items if/when they arrive.

I also noticed that the timeframe listed for the items in the email is actually BEFORE I received it… which means, if I was in the mood for some humor, I’d reply back and inform this person that I had missed the deadline and need to reschedule… *BAM* confirmed email list.

I also did a search on the item numbers in the email.

the GRC79 is a Toshiba refrigerator

http://www.select.co.id/K1/K1%20toshiba_gr79.htm

It’s probably a coincidence, but what the heck. I’m already in the middle of a long email to a total stranger, so why not add more useless info 🙂

all the best,

-Kevin

I’m not sure it is useless. I’d think someone told him about the GRC79 in a mail, maybe even sent him a fan motor from it or something… As for the pickup. Well see above.

———-

From: ”Tony A. Emond”

Date: fre aug 1, 2003 21:52:29 Europe/Stockholm

Subject: time-traveller spam

So many people seem to have received that spam, there ought to be some sort of ‘time-traveller spam’ web ring to round up all the web pages on the subject!

Here’s mine:

http://clevershark.com/index.php?section=articles&article=9

Cheers,

TAE



”Those who would give up a little freedom for a little security will soon find that they have neither.”

-Winston Churchill

I don’t really like webrings, but this page could be something of a catalogue though…

I do like that footer. It goes into my radome quote generator.

———-

From: ”mmilch”

Date: lör aug 2, 2003 00:08:29 Europe/Stockholm

Subject: time traveler

Hey —

The guy’s definitely still at it. I got a new email from him today — the first since the original one I got. I didn’t bother opening it.

I can tell whenver he does anyway because my traffic spikes up from people using search engines. I’ve gotten a lot of hits from your site, too — thanks for the link to my site in your earlier time-traveler post post.

Anyway, thanks again, and hopefully in the future, we won’t have potentiallly psychotic people sending out mass emails. If he ever finds his parts, maybe he’ll let us know.

Mike Milch

albanydan.suckahs.org

Yup! That would be nice. A mass mailing to a few hundred million addresses saying ”Thanks for all your help”, dated 2954 or something…

———-

From: ”Lilith Murosako”

Date: mån jul 28, 2003 21:38:02 Europe/Stockholm

Subject: Dimensional Travellers

Hey, you know, since ‘UFO’ nauts seem to mess with telephones (re: Colin Wilson and John Keel) I suppose it was only a matter of time before they got to the internet. In medieval times it was demons and angels, nowadays it’s UFOs and ‘dimensional travellers.’ Sheesh.

Lili

— Rev. Lilith Murosako

Potium mori quam foedari.

Some mornings it’s just not worth chewing through the leather straps… —–Emo Phillips

Eeeeh? I normally don’t get the mening of what reverents say, and this was no exception.

————

 

 

John sets us straight on the random letters

 

From: ”John Laur”

Date: mån jul 28, 2003 21:35:27 Europe/Stockholm

Subject: The DWG E-Mail

Hello,

I wanted to set the record straight on the purpose of the random letters in the subject line and body of the email for you.

The ONE AND ONLY reason they are there is to assist the message in passing spam detection systems that use message/subject signature verification such as Vipul’s Razor. By including a sufficiently long string of random characters in an email it makes the subject and body of each different copy of the spam unique, thereby defeating systems at larger ISP’s who spam check for duplicates such as these. Unfortunately, the method is very effective at bypassing these types of filters when employed properly.

There are a lot better ways to track bounces than to use some kind of key inside the body. MTA’s typically reformat the original message in some form if they even include it in the bounce. Most often, the spammer will set the envelope sender to a bounce tracking address that includes the email address to have bounced. You can find the envelope sender’s address in the Return-path: header added by all modern MTA’s, and remember that the From: header has NOTHING to do with where the message came from.

Thus, if someone is trying to mail user@host.com and they set the envelope sender to trackbounces-user=host-com@myisp.com, then the receiving MTA will bounce the message (if it can’t be delivered) to an address that can parse out the intended recipient based on the To: address and remove the user from the list without requiring a unique key to be added to the body or the subject of the message. I hope that makes some sense.

Spammers; however, never use the bounce tracking technique I described above since it would reveal their origin. Besides, why would they want to trim down their lists when they just want to have bigger and bigger lists?

John

Thanks for straighting that out for us John. It sounds right. I adm nister two true opt in mailing lists myself (that’s one of the reasons why spam mails make me so mad) and we use pretty much the same technique you described in your mail. And now I understand the random stuff as well. Great! We also use a technique on these lists where we track weather anyone ever open their mails. This makes it possible to remove uninterested subscribers after a certain time. That’s something spammers would never use!

 

Philip tried to make contact

Philip Holan is one of the many who tried to make contact with Time Traveller Bob. However, Bob/Robert seems to have learned about newer stuff by now (thanks to Dave Smith no doubt).

From: ”Philip Holan”

Date: mån jul 28, 2003 04:36:03 Europe/Stockholm

Subject: Time traveler

Well Nikke, Here is something else to add to the puzzle. It contradicts some of the theories posted before.

After receiving this emails a few times, it upset me that they did not contain an opt out. So I decided to get a hold of him, just to ask him to remove me from his list. I basically told him that I had the items he was looking for.

I was surprised when 2 days later, I got a call from him!!! He wanted to do business with me. If this was a hoax, why would he call me? even better, why would he incurr into long distance charges?

But, here is another puzzle. I just got a new email today, it looks like he now wants a newer version of the device!. He is now requesting 512 SRam and four I80200 warp stabilizers instead of the initial 2.

Tough to keep up, isn’t it? There’s always an updated version. And it might be even harder in the time travel racket. Even if you get the latest model, there is always a newer version after you travel forwards in time…