Rick's spam digest :: Classic spam: He gets paid for your opinions

home | legal stuff | glossary | blog | search

Legend: new window outside link tools page glossary link

Classic Spam: He gets paid for your opinions

The bottom line: Offering you money (directly or indirectly) for "your opinions" is a standard opening gambit in many spam-based rackets and frauds.

I’ve frequently received messages of this sort in the past, but never before looked into them (since they are so obviously spam); More recently, however, I decided that this might be a fit topic for yet another adventure in Classic Spam.

Return-Path: hidden
Received: from c-67-162-241-45.client.comcast.net
 ([192.168.1.4]) by mta006.verizon.net
 (InterMail vM.5.01.06.06 201-253-122-130-10620030910)
 with ESMTP id
 <20040527233427.BHKW27313.mta006.verizon.net@c-67-162-241-
 45.client.comcast.net>;
 Thu, 27 May 2004 18:34:27 -0500
Received: from c-67-162-241-45.client.comcast.net
 (67.162.241.45) by sc010pub.verizon.net
 (MailPass SMTP server v1.1.1 - 121803235448JY)
 with SMTP id <3-4229-38-4229-413475-1-1085700849>
 for mta006.verizon.net; Thu, 27 May 2004 18:34:28 -0500
X-Message-Info: 1CFPDE0IwyqxlBTR7sZoymASJ1yciWBFaatIXGaB5XBA
Received: from dnsD4.saske.sk ([101.64.165.218])
by 68Bm-lAF.67.162.241.45
with Microsoft SMTPSVC(5.0.9CDA.5A59);
Fri, 28 May 2004 04:31:07 +0400
Message-ID: <ADE8_________FD5D@67.162.241.45>
Reply-To: "Buddy Stapleton" hidden
From: "Buddy Stapleton" hidden
To: several addresses hidden
Subject: 34- No joke, companies will actually pay for your views
Date: Thu, 27 May 2004 17:31:07 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--FE7817C8A64AC9A37314"
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade1
X-Spam-Level: *****
X-Spam-Status: hits=5.6 tests=BIZ_TLD,HTML_40_50,HTML_FONTCOLOR_BLUE,
HTML_FONTCOLOR_UNSAFE,HTML_FONT_BIG,HTML_MESSAGE,MIME_HTML_ONLY,
MIME_HTML_ONLY_MULTI,SERIOUS_CASH version=2.63

----FE7817C8A64AC9A37314
Content-Type: text/html;
charset="iso-BC36-0"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<title>"where experiments could be conducted without risking blowing up th=
e laboratory. The computers manifestation as a simulation device during an=
d in particular in the post-war years open up what Manuel de Landa has cal=
led an ""epistemological reservoir.""[25] E"</title>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859=
-1">

</head>

<body>
<div id=3D"Layer1" style=3D"position:absolute; width:382px; height:196px; =
z-index:1; left: 183px; top: 92px; background-color: #CCCCCE; layer-backgr=
ound-color: #CCCCC3; border: 1px none #000002;">
  
  
  
  
  
 <a href=3D"http://www.go64.biz/takeoff/takeoff.html"=
>to get off our database</a>
</div>
<div id=3D"Layer2" style=3D"position:absolute; width:340px; height:172px; =
z-index:2; left: 203px; top: 104px; background-color: #FFFFFC; layer-backg=
round-color: #FFFFF0; border: 1px none #000007; overflow: visible;">
  
 Do you want to make some serious cash with just your =
opinion?
 <a href=3D"http://www.go64.b=
iz/srv.html">GET MORE INFO</font=
></a>
  
 </div>
 
 
 
 

even showing behavior characteristic of pets Field=
4 Artificial Intelligence
but what you get is only the program. You only dow=
nload the object and not the collective that a quasi-object would bring wi=
th it. If we look at this from a non-modern perspective Field7 Artificial =
Life
Boyle contributed to the debate 48) For Freud thes=
e objects were not physical or material but objects such as 'slip of the t=
ongue and 'dreams' how they use surrounding objects to construct theories =
about life. Piaget discovered that children work as small scientists conti=
nually posting and testing theories for how things and the world works. At=
that time the world was full of things that could b
but we can draw parallels in the solution. Boyle s=
olved the dispute about the vacuum by arguing empirically and developing e=
xperimental science 67 - 68). L=E9vy is a bit vague on the need for an et=
hics of Cyberspace modified and altered in any way. A homepage manifest it=
self as a representation of information in virtual worlds

</body>
</html>

----FE7817C8A64AC9A37314--

Opinions are like nostrils -- everybody’s got at least one. And, while you and I know in our hearts that our own opnions are always impeccably correct and well founded, it couldn’t hurt to receive outside validation of the fact, particularly if some cold cash comes along with the deal. Apparently, this giving-your-opinion business is so lucrative that, according to one unsigned testimonial on the spammer’s website, “...all we do is take a few surveys in the morning and then go out and enjoy the day.” Ah, yes, the life of the opinionated gentry. The perp claims that you can earn up to $500 per month “part time,” or else sit in front of your computer all day and “...make enough money to eventually quit your current job.”

And so, I visited the perp’s website to find out how I could hop on this consumer-culture gravy train. Guess what? Of course — YOU HAVE TO PAY FIRST in order to make money from your opinions!

So, let me get this straight -- normally, I’d have to pay nearly forty bucks to make money from my opinions, but thanks to the stupid wedding clip-art I only have to pay $15? (By the way, 15 bucks is actually more than 50% off, but you have to take into account that this chickenboner probably can’t do math if it involves counting past twenty-one — or twenty, if the spammer is a lady.)

Now, fifteen clams is probably below most people’s threshold of pain, so the spammer stands to make quite a bit of money from people who take a shot in the dark, even if all he has to offer in exchange is some wormy old “database” of false leads and contacts. Plus, since the spammer now has the victim’s credit card info, he might well be able to derive even more from the transaction (!!).

Yes, there are market research firms who will pay you a nominal amount to sit in on focus groups and such, but if you think you’d make a living from this, you’re woefully misinformed. And anyway, the firms who run these things are always fairly careful about selecting their participants, and don’t hold general “cattle calls” ("Don’t call us, we’ll call you.“) A ”professional" opinion-giver is probably about the last person they’d want in their surveys.

Just because I’m grouchy today, I’m going to go the Full Monty on this message.

The header indicates that the message comes from what looks like a Comcast home user (c-67-162-241-45.client.comcast.net), and the HELO name is unforged, which suggests that we’re looking at an open proxy (or at any rate a direct-to-MX mailing). The routing line after this is completely forged; there’s no such host as dnsD4.saske.sk, and the IP address 101.64.165.218 is an unassigned, unrouteable address (reserved by IANA).
There’s an X-Message-Info header line between the real and forged parts of the routing; it isn’t an “official” mail header line, but such lines can be inserted by any mail program (honest or not) for various private uses. Possibly this line means something in code to the spammer, it is hard to tell.
The website at http://www.go64.biz/ has no real index page (it is “under construction”). It lives at 219.153.7.125, in the chinanet.cn.net netblock. The domain name “go64.biz” is registered with Gandi by one Lenny James at 711 Route 46 East, Fairfield New Jersey. His contact phone number is given as (650) 423 4544 -- hmm, funny, that’s a Redwood City, California exchange! The poor guy must spend so much time commuting between coasts that he doesn’t have time to sit in front of his computer and get paid for his opinions. He is, however, getting paid for your opinions -- if you fall for this scam, that is.

The message itself is an exercise in padding. In addition to the ridiculous page title (in pink highlight), he also includes a big swatch of “neutral” text (in green highlight) that has a color ( #FFFFF2 ) that is just slightly yellower than pure white ( #FFFFFF ), so a spam filter would have trouble spotting it as invisible (even though you can’t see it). This is sometimes known as the “nearly-invisible ink” trick. With such a large proportion of “non-spam” text, it is possible that this message could slip by Bayesian spam filters.
I’ve left in the header lines (red highlight) inserted by my filter service’s implementation of SpamAssassin to show you the sorts of things that SpamAssassin can find (It didn’t spot the nearly-invisible ink, but it did flag it as an “unsafe HTML font color”).

Like you, I prefer to get paid for my opinions, but I have some about this spammer that I’d be willing to give away for nothing.

home | legal stuff | glossary | blog | search

Legend: new window outside link tools page glossary link

01496 hits since March 28 2009

Updated: Sat, 18 Aug 2007