The Monthly Lupine Awards
for MMF - June 1997
Starting sometime in May, I set up a special mail alias for people to
send reports of Make Money Fast chain letters to. Anyone who spots a
chain letter where it shouldn't be (which is nearly anywhere) is welcome
to send it, headers and all, to:
chainsaw@news.msfc.nasa.gov
You won't get a reply. I won't necessarily cancel any articles you send
me. I use what I receive to tweak my Make Money Fast detector so that it
can catch new variant forms. Please send only one article at a time.
You don't have to send more than one copy of a given type.
I haven't exactly been overrun with contributions, but I am extremely
grateful to the following individuals for their support of this little
experiment in June:
submissions name
----------- ----
14 Fried Spam
3 Tim Jokela
2 Todd C. Lawson
1 Per Bilse
1 Seth Breidbart
1 Ken Lucke
Most of these were automatically detected by the MMF detector.
Typically, these posts merely hadn't made it to my server yet, or else my
cancels hadn't made it to their servers yet. I did receive a few new
variants, including one in Swedish, I think.
So much for the Good Guys. Now for the Bad Guys...
The following table lists the number of "Make Money Fast" (MMF) chain
letter articles I have canceled from my site, news.msfc.nasa.gov, by
article header From address, for the month of June, 1997, ranked by
number of articles. I only list the top 40. The numbers could vary
significantly from site to site; other people cancel these things as
well, and some sites (such as AOL) do not honor cancels at all.
Please note that forged and/or mangled names and addresses are common.
---------------------------------------------------------------------------
The Golden Lupine award goes to:
Rank Posts
---- -----
1 1314 [spammer@netzilla.net]
This set of articles bore From addresses of a@a.a, a1@a.a, a2@a.a, etc.
The name in the pole position was:
J. Martin
P.O. Box 2292
Reston, Va. 20190
I normally save all of the MMF's that I cancel, but a disk crash in early
June wiped out all of my copies of this spam, which had stopped shortly
before. At the time, I identified them as coming from Netzilla, but the
copies on DejaNews don't have enough header information for me to be able
to tell absolutely.
---------------------------------------------------------------------------
The Silver Lupine award goes to:
Rank Posts
---- -----
2 861 [spammer@ibernet.es]
This is effectively a continuation of the Peter Kjoge/Odd Hilsen/etc. MMF
spam that took the Bronze Lupine in May. This spammer uses various From
addresses like these:
33S5W@8DQ60.ORCRM 4OK4C@4O64B.MU39B 64LLO@VXBOT.Q9UZB A344C@4I9XF.XCXVB
C5AD7@JXV27.VDGEX HDDL9@VSEZD.V7G0X JNEDB@8RN8N.SMUY4 MZ2VT@I6JE5.KYZ3J
O2HAO@NYGOY.3U6XF PBJUJ@L794L.SX22E PELTT@D43FR.JMSGJ W9YDT@BIFJR.FJ3HO
WAOYX@CWVXE.NO7LI WR51Z@WEU7E.J7LOF
In May, this spammer was posting one article per address except for a few
that repeated. Late that month, he switched to posting 20-50 times per
address, and this pattern continued into June. As far as I can tell,
this spammer is still crankin' 'em out. I have had no luck in getting
any sort of response from various ibernet.es addresses.
Despite the .es address, these MMFs were in English.
The last two names on the list are sometimes swapped. They are:
Odd Hilsen Peter Kjoge
Avda Espana 93 Camino de la Condesa 9, 5-A
Sitio de Calahonda E-29640 Fuengirola
Mijas Costa - Malaga Spain
Spain
---------------------------------------------------------------------------
The Bronze Lupine award goes to:
Rank Posts
---- -----
3 795 "0013"
"Gustavo C."
"gaviota"
"0013" <0013@usa.net>
Despite the From address, these English-language MMFs seemed to come from
this person:
GUSTAVO CISNERO VLN 1151 P.O. BOX 025685 MIAMI FL 33102- 5685
However, it is not clear to me why someone from Miami would resort to
sending MMFs through a Venezuelan server (news.telcel.net.ve).
I did run into a stray posted from news.one.se, and there were some
suspicious-looking quoted MMFs of this sort from news.embratel.net.br as
well.
As far as I can tell, this spammer is still operating.
---------------------------------------------------------------------------
The rest of the top 40:
Rank Posts
---- -----
4 685 holck@post3.tele.dk (Morten Holck)
5 527 Grahame Elton<31 A Hong Kong Street Singapore 059670>
6 478 DONT.PASS@THIS.UP
7 430 "Dennis Y."
8 412 "$MONEY$"
9 403 lotsacash@here.com
10 367 goat@satcom.whit.org
11 321 "D.Sanchez"
David Sanchez
12 309 artistjda@aol.com (Artist JDA)
13 306 EASY MONEY
Jim
NEED CASH?
14 302 Getting_There@Last.com
15 301 "DOLLAR BILL"
DOLLAR BILL
16 299 thecat@.the.hat ($$MONEY!!$$)
17 295 ksgrubbs@erols.com
18 293
19 281 Michael Layne Burrus <"mburrus@wwisp.com"@wwisp.com>
20 273 "The Druid"
21 247 Penni
22 244 "A&C" <72012,724@compuserve.com>
23 238 newman8406@aol.com (Newman8406)
24 230 "Timothy, Mary & Shannon Carson" <1108k@sensible-net.com>
25 224 eNIGMA
25 224 Henny Van Kooten
26 218 dcluka@aol.com (DCluka)
27 216 "job opp."
IMPROVE YOUR LIFE
IMPROVE your LIFE
Improve your life
change life
28 210 "Duane M. Kirkpatrick"
mrmcgee@geocities.com
29 201 "Paul"
30 200 The Regele's
31 197 "Tim Flanary"
32 191 Andy
Mailman
33 189 darth10371@aol.com (Darth10371)
34 188 pinion4635@aol.com (Pinion4635)
34 188 Cashmoney
Lotacash
lotacash
34 188 "Walter"
"William"
35 184 Kissme
36 181 "Jason Wynn"
37 175 wasted187@aol.com (Wasted187)
38 174 shamrok82@aol.com (Shamrok82)
39 169 "Jay-Tea"
40 168 vrycl@axionet.com
40 168 <@>
--------------------------------------
Total articles canceled: 42897
Total unique Froms: 1581, counting the netzilla.com and
ibernet.es spammers as 1 each
There are 43200 minutes in June, so the Barnum Rate was a sucker every
27.3 minutes, and there were approximately 0.99 cancels issued per
minute, a tiny decrease from May.
I have compiled a list of the most MMF-ridden newsgroups in June 1997.
Please note that this list is affected by many factors, such as:
1. I don't get (or want) a full feed here, and a lot of the newsgroups
listed are mostly leakage or crossposts.
2. I don't cancel articles in moderated newsgroups and certain others
(such as news.admin.*).
3. Crossposts are listed as if they were multiple posts, unlike the
Lupine Awards list above.
4. The activities of other third-party cancelers are not compensated
for.
With that in mind, here are the top 40 "MMF magnets" for June 1997.
rank arts newsgroup
---- ---- ---------
1 229 alt.business
2 187 alt.business.home.pc
3 169 alt.business.misc
4 160 alt.2600
5 150 ab.jobs
6 145 alt.business.multi-level
7 143 alt.america.online
8 138 alt.activism
8 138 a.bsu.programming
9 128 alt.alien.visitors
9 128 ab.general
10 120 3b.config
11 117 alt.adoption
12 115 alt.0d
12 115 5col.forsale
13 114 alt.bbs
13 114 a.bsu.talk
14 113 alt.amazon-women.admirers
14 113 alt.alcohol
15 111 alt.1d
16 110 alt.3d
17 109 alt.abortion.inequity
18 108 3b.misc
19 106 alt.bbs.ads
20 104 alt.sex
20 104 alt.astrology
21 103 alt.make.money
22 102 alt.anything
23 101 alt.beer
23 101 3b
24 99 alt.bbs.internet
24 99 alt.alien.research
25 98 can.forsale
26 97 ny.forsale
26 97 alt.business.home
27 96 nyc.forsale
27 96 alt.alt
28 95 queens.forsale
28 95 ont.forsale
28 95 alt.adjective.noun.verb.verb.verb
28 95 a.bsu.religion
29 94 tor.forsale
29 94 ott.forsale
29 94 niagara.forsale
29 94 can.atlantic.forsale
29 94 alt.ads
29 94 acadia.bulletin-board
30 93 tor.forsale.computers
30 93 ott.forsale.other
30 93 ott.forsale.computing
30 93 mtl.vendre-forsale
31 92 nyx.forsale
31 92 mtl.forsale-vendre
31 92 misc.entrepreneurs
32 90 abg.amiga
32 90 5col.general
33 89 5col.announce
34 87 alt.acting
35 86 alt.acme.exploding.newsgroup
35 86 alt.aapg.general
35 86 abg.biete
35 86 3b.test
36 85 alt.basement.graveyard
36 85 alt.alt.alt.alt.alt
37 84 alt.aol-sucks
37 84 alt
38 83 alt.baldspot
38 83 alt.algebra.help
39 82 alt.amateur-comp
39 82 alt.aapg.announce
39 82 alt.3d.studio
39 82 alt.2600.crackz
40 81 alt.2600hz
40 81 3do.bad-attitude
--
J. Porter Clark, d/b/a
+--+
|oo| The Unknown News Administrator
| | news@news.msfc.nasa.gov
`^^'
