Topic: Okay I am truly confused now (Read 11608 times)

nekowafer · « **on:** 15 Jul 2013, 19:46 »

Semi comic related I guess maybe? But I just got this e-mail:

WHO DID THE THING

Masterpiece · « **Reply #1 on:** 15 Jul 2013, 23:05 »

Scary

Masterpiece · « **Reply #2 on:** 15 Jul 2013, 23:45 »

You should answer it

nekowafer · « **Reply #3 on:** 16 Jul 2013, 01:48 »

I did! No response yet.

ankhtahr · « **Reply #4 on:** 16 Jul 2013, 02:52 »

"This message may not have been sent by MariGoldFarm"

Are you sure Gmail? Are you really sure?

But actually I think that might indicate that the mail wasn't even sent from that address, but simply with this address as "from" and "reply-to" header. You might find out more if you gave Gmail show you the headers/the whole message. Sometimes it's possible to see which server started the message.

mtmerrick · « **Reply #5 on:** 16 Jul 2013, 03:30 »

Why neko though? Is it just her?

Masterpiece · « **Reply #6 on:** 16 Jul 2013, 03:36 »

Maybe Marigold thought "Neko looks like she really wants those Spaghetti - O's?"

J · « **Reply #7 on:** 16 Jul 2013, 04:16 »

maybe qc is a popular read among spambots, what with it's positive portrayal of AI & all.

Masterpiece · « **Reply #8 on:** 16 Jul 2013, 05:25 »

Augh! I just checked my spam folder:

cesium133 · « **Reply #9 on:** 16 Jul 2013, 06:26 »

It's not that hard to spoof email headers.

I'm not the person who did it, though. I don't know anyone's email address.

nekowafer · « **Reply #10 on:** 16 Jul 2013, 06:29 »

I responded and got a confused message back from the person who actually owns that email.

And that is awesome, Masterpiece. Did anyone else get anything?

Someone is being a super nice troll apparently <3

Masterpiece · « **Reply #11 on:** 16 Jul 2013, 07:24 »

I looked through the header. I found references to a "mail.fakemailer.nl".

(click to show/hide)

Code: [Select]

x-store-info:fHNTDlzCF8Nxw6HwcfGQy+S7Ax/lqLSmNphQ3OF+T9E=
Authentication-Results: hotmail.com; spf=temperror (sender IP is 46.21.172.149) [email protected]; dkim=none header.d=outlook.com; x-hmca=none [email protected]
X-SID-PRA: [email protected]
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0wO0Q9MjtHRD0yO1NDTD00
X-Message-Info: 5cuOr7VrmjDnolvGJzLggrtg0b7uw+oWD+eFuzLFp8RlYpVM3+ln4Sl1OxGRJqJCEQHcimG4KJSAFxjT1ePFM51J2PJWDiGJeh/LT8ZLsdZPMGYbErRuGLKqW+rmba3s+3c9JWRlKSYUwQyw97CKLmUS/bbyamE9qn1A07+p4F4=
Received: from vserver52.axc.nl ([46.21.172.149]) by BAY0-MC2-F14.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
	 Mon, 15 Jul 2013 23:34:05 -0700
Received: from vserver52.axc.nl ([46.21.172.149] helo=mail.fakemailer.nl)
	by vserver52.axc.nl with esmtpa (Exim 4.76)
	(envelope-from <[email protected]>)
	id 1Uyypp-0003WF-A3
	for <myemailgoeshere>; Tue, 16 Jul 2013 08:34:05 +0200
Date: Tue, 16 Jul 2013 08:34:05 +0200
To: <myemailgoeshere>
From: Dale <[email protected]>
Reply-To: Dale <[email protected]>
Subject: []_[]
Message-ID: <[email protected]>
X-Priority: 3
X-Mailer: PHPMailer 5.2.1 (http://code.google.com/a/apache-extras.org/p/phpmailer/)
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="b1_42ed96af945a70ae8c5dee663c91ed76"
Return-Path: [email protected]
X-OriginalArrivalTime: 16 Jul 2013 06:34:06.0236 (UTC) FILETIME=[786445C0:01CE81EE]


--b1_42ed96af945a70ae8c5dee663c91ed76
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit

Daaaaaaaaaaaaang


--b1_42ed96af945a70ae8c5dee663c91ed76
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: 8bit

Daaaaaaaaaaaaang



--b1_42ed96af945a70ae8c5dee663c91ed76--

(click to show/hide)

Code: [Select]

x-store-info:fHNTDlzCF8Nxw6HwcfGQy+S7Ax/lqLSmNphQ3OF+T9E=
Authentication-Results: hotmail.com; spf=temperror (sender IP is 46.21.172.149) [email protected]; dkim=none header.d=gmail.com; x-hmca=none [email protected]
X-SID-PRA: [email protected]
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0wO0Q9MjtHRD0yO1NDTD00
X-Message-Info: 5cuOr7VrmjAC2LpYre8Qz/B42WNdbxfGUi19knWLin2RkNJuI+Zycu/qBnlnwbpnSwpG0WF+YYQSa5SkWgpWgFJce1x1Q4JDJeiqSjt1mflolG8cFhVPJUEUW4io5oSrAU1yCgvlTQf3ToGmosQayforPbmiqAnnS+0JvlESxUE=
Received: from vserver52.axc.nl ([46.21.172.149]) by BAY0-MC1-F17.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
	 Mon, 15 Jul 2013 19:28:50 -0700
Received: from vserver52.axc.nl ([46.21.172.149] helo=mail.fakemailer.nl)
	by vserver52.axc.nl with esmtpa (Exim 4.76)
	(envelope-from <[email protected]>)
	id 1Uyv0T-0005Li-3G
	for <myemailgoeshere> Tue, 16 Jul 2013 04:28:49 +0200
Date: Tue, 16 Jul 2013 04:28:48 +0200
To: <myemailgoeshere>
From: Hannelore Ellicott-Chatham <[email protected]>
Reply-To: Hannelore Ellicott-Chatham <[email protected]>
Subject: Are you aware
Message-ID: <[email protected]>
X-Priority: 3
X-Mailer: PHPMailer 5.2.1 (http://code.google.com/a/apache-extras.org/p/phpmailer/)
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="b1_c78b120cb5fa2df59d2fc2aa33ff4c49"
Return-Path: [email protected]
X-OriginalArrivalTime: 16 Jul 2013 02:28:50.0789 (UTC) FILETIME=[354D4150:01CE81CC]


--b1_c78b120cb5fa2df59d2fc2aa33ff4c49
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit

Are you aware how messy your room is? Clean it up mister.


--b1_c78b120cb5fa2df59d2fc2aa33ff4c49
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: 8bit

Are you aware how messy your room is? Clean it up mister. 



--b1_c78b120cb5fa2df59d2fc2aa33ff4c49--

ankhtahr · « **Reply #12 on:** 16 Jul 2013, 08:32 »

So if I see that right somebody who has access to fakemail.nl has sent the messages. The mail server of mail.fakemail.nl (which is registered and hosted at the Dutch provider "Tele2") has given these messages into the hotmail server, saying that these were received for Masterpiece's address, from the spoofed "from" address. I've seen this done much better though.

I wonder how the sender managed to deliver the mail into the hotmail.com server.

Masterpiece · « **Reply #13 on:** 16 Jul 2013, 09:27 »

Or the gmail address.

ankhtahr · « **Reply #14 on:** 16 Jul 2013, 09:34 »

nah, the second one was also delivered directly into the hotmail server. It just had gmail as envelope address.

Masterpiece · « **Reply #15 on:** 16 Jul 2013, 09:36 »

I was referring to the email that arrived in Nekos inbox.

nekowafer · « **Reply #16 on:** 16 Jul 2013, 15:00 »

Here's what mine says:

(click to show/hide)

pwhodges · « **Reply #17 on:** 16 Jul 2013, 15:03 »

fakemailer.nl again.

I'm surprised that gmail doesn't have a stronger SPF record, though, because that could have been enough to stop this.

nekowafer · « **Reply #18 on:** 16 Jul 2013, 15:05 »

My guess is that it's someone being nice, though - they saw that I've been posting a lot of sad stuff lately. As for Masterpiece, I don't know.

Masterpiece · « **Reply #19 on:** 16 Jul 2013, 15:07 »

I have my suspicions on who sent me this, but I won't post them publicly.

snalin · « **Reply #20 on:** 16 Jul 2013, 15:12 »

The http://www.fakemailer.nl/ website has the blank wordpress "nothing added yet" page up. You may set up outlook (and probably gmail too) to work with a custom domain, so that's probably what's been done.

I love the style of this troll. Since it's not going out to everyone, it's probably coming from someone who has both your emails.

nekowafer · « **Reply #21 on:** 16 Jul 2013, 15:17 »

I like it a lot, it made me smile. I am very curious about it, though.

Welu · « **Reply #22 on:** 16 Jul 2013, 15:21 »

The one to Neko is adorable. No idea who'd be doing it though.

Masterpiece · « **Reply #23 on:** 16 Jul 2013, 15:30 »

Yeah I've talked a bit and researched some more and now I'm pretty sure I know who sent it to me.

pwhodges · « **Reply #24 on:** 16 Jul 2013, 15:39 »

If you have not blocked the ability of people to email you in your profile, then your email address is available (to logged-in users, not guests).

I would consider the misuse of members' email addresses for sending anonymous or fake emails to forum members to be a potentially bannable offence.

nekowafer · « **Reply #25 on:** 16 Jul 2013, 15:41 »

I do want to mention that I have given this e-mail out to many people, and posted it in many places both on this forum and elsewhere. I am not worried about someone sending me nice things like this, or if they want to talk, but I can absolutely see where it could get out of hand.

pwhodges · « **Reply #26 on:** 16 Jul 2013, 16:20 »

I have no desire to demonize anyone; but the use of forum facilities for sending anonymous emails, even for fun, is a misdemeanour that merits a ticking off. If it were to go further, it could merit more than that.

ankhtahr · « **Reply #27 on:** 16 Jul 2013, 23:16 »

I didn't receive anything, even after checking my spam folder. OTOH I was more careful with giving my address away.

I could imagine that the blank page on fakemail.nl is meant to discourage you from looking. All three mails were (at least if that part of the header hasn't been forged) sent using the same Webmailing interface (PHPmailer).

And I agree with pwhodges, I don't like this at all.

Patrick · « **Reply #28 on:** 17 Jul 2013, 00:42 »

I can't remember if my email address is on my profile here, but I generally don't give it out to anyone ever. Because as far as my online socialization's concerned, email's old news.

mtmerrick · « **Reply #29 on:** 17 Jul 2013, 00:53 »

Uhhhh, what are you talking about? It routes the emails through SMF software, to hide the recipient address - that way you can be contacted, but not spammed. Email addresses are not public on userpages (at least to standard users, I don't know about mods)

pwhodges · « **Reply #30 on:** 17 Jul 2013, 02:03 »

Oops - yes, I sometimes forget that I get a different view from other people.

However, many people also have in their profile links to other sites which may present information which enables an email address to be guessed or deduced; and in the case of two people on this page one of those links includes a full email address as it stands.

Masterpiece · « **Reply #31 on:** 17 Jul 2013, 03:06 »

Let's put it this way: the fact that the emails were qc-related and went to the address I used on qcvetse, first made me jump to the conclusion that someone in charge of the forums sent me this mail. I'm sure that is not something Paul would want people to think.

snalin · « **Reply #32 on:** 18 Jul 2013, 11:51 »

Maybe it's Jeph being silly when drunk again?

LTK · « **Reply #33 on:** 18 Jul 2013, 12:05 »

He quit drinking, but that doesn't preclude him being silly.

Masterpiece · « **Reply #34 on:** 18 Jul 2013, 12:08 »

Jeph doesn't use Android phones, and I know from a reliable source that the mails were sent from an Android.

pwhodges · « **Reply #35 on:** 18 Jul 2013, 13:06 »

Yes, the program used to send these mails, Fake Mailer, is specifically an Android app. I note that it is classified by Google as a "game", and that a single user is limited to sending no more than three emails a day from it.

But why on earth would anyone even think of Jeph doing something like this (not least, on the very rare occasions he trolls people, he does it loudly and publicly)?

nekowafer · « **Reply #36 on:** 18 Jul 2013, 15:35 »

Maybe nice-trolling is different? But yeah I didn't know it was an android thing. Good to know.

mtmerrick · « **Reply #37 on:** 18 Jul 2013, 17:26 »

I highly doubt jeph did this.

THESE FORUMS NOW CLOSED (read only)

Author Topic: Okay I am truly confused now (Read 11608 times)