I give you... The Scam-O-Matic!

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Not quite a Newb Joined: 30 Sep 2010 Posts: 45

This will probably not work, but I'm trying out an idea to waste more scammers' time, and less of mine. Going one on one is fun, but it takes the same, or more, of my time as it does theirs.

So we tossed around ideas for how to get scammers to work each other, but that proved to be as likely as perpetual motion. So I finally decided to make a monthly contest between scammers.

So I created a honeypot email account, and sent it out to all kinds of nasty lads. Anything sent to this email account gets what GMail calls a "Canned Response". Unless, that is, it has the word "research" in the subject. More on why in a sec.

In the body of the canned response any poster gets is a message saying that basically "I know you are a scammer, but I need your help." I represent a research firm funded by the US Homeland Security that has to determine how best to identify a scammer.

To sweeten the deal, I pay $1,000 each month to the "researcher" that identifies the actual scammer from a list of email addresses I distribute to all registrants at the beginning of the month. The email they all get also has the URL of the form to fill out to register for that month, as well as detailed instructions, and the URL to submit your 'vote' at the end of that month.

So each scammer goes to the URL I gave, and lands in a typical Google docs form. Just a few fast questions, and that is it. I'm still tweaking it, but right now there is no email confirmation on that one. But when you do click Submit, you do see the rules & links pasted again for reference.

During the month's "contest", or "game", each scammer is told to chose any number of likely email addresses from the list, and be the victim, letting the "researcher" they chose be the scammer. So basically, I'm asking each scammer to play the role of victim in order to determine which of them all is the most likely real scammer.

Have I lost you yet?

The scammers all get a URL to another Google docs form for casting their vote. Once they submit, they are told the results will be emailed to them. So I wrote a clever ditty in Google scripts to grab their email from the spreadsheet GD creates, and craft an email by hand. The email informs them that unfortunately they have not chosen correctly-no matter what they voted.

"Sorry! Try again!" ...and all that.

Now, the rules for the competition are a little demanding, as there is $1,000 on the line. For one, all emails have to be sent to me with the word "researcher" in the subject line somewhere (remember above?) Not only that, but the 'victims' must produce pictures of the scammers they chose-especially of the one they are voting for. So they have 30 days as a victim to get photos. To make things nicer, I offer a $250 bonus to the best, most creative picture for the month.

And that is it. Oh... and one more thing. Every researcher is a scammer. So no matter who they chose, they would be correct. But alas they will never win.

So it's up & running now (maybe buggy), and all you have to do is send an email to: <a href="mailto:[email protected]">[email protected]</a> ...really rusty, and probably full of flaws/typos/etc. but as a concept?

Your thoughts?

The Good Doctor Flatula

Posted: Mon Jan 23, 2012 12:33 am

Wow. I'm lost. But hopefully so will the lads be. See how it goes, it's all good to try out.

Autoresponders are great things with as many uses as a large screwdriver Wink

Not quite a Newb Joined: 30 Sep 2010 Posts: 45

Thanks NG!

If I get enough bites, I'll automate the end of month emailing out of email addresses. At that point, I expend zero effort. Scammers send me crap emails, I respond with an offer, they play against the other scammers until they tire, and I've hopefully wasted dozens' of scammers' days, while I don't lift a finger.

I think that is the driving force behind the Scam-O-Matic... We all get thousands of scam offers each month, and nothing is done with them... They just sit, and after 30 days they are deleted. So why not use all that information to make them all play against each other-at once both scammer & victim!

So it IS a way to make the scammers waste only their time amongst them, and not even a baiter need be involved. Perhaps the greed they claim all Americans have has rubbed off on them...? :)

There seems to be a simple elegance to automating a way for them to waste time on each other...

I Chop Your Dollar
http://www.youtube.com/watch?v=kJOuvEcarNs

Edit: How to use your SPAM in GMail

If you want to make your own responder, and don't want to let all those very useful, fresh spams go to waste, here is how you do it.

1. Create a filter in GMail.
2. Clear all fields, then put is:spam in the "Has Words" section.
3. GMail will bitch, so click OK...
4. In my case, I copied/pasted the email my [email protected] was sending out to scammers, and made a new Canned Response.
5. Now if anyone sends spam to my 'normal' account, they get the same email back that Baba will send them.

So All I am doing is directing all the scammers from 2 accounts to a GD form. All you need to do in order to help point scammers to my forms is to copy/paste as I did above the email body you will get back immediately to your email to [email protected].

So if you aren't going to do anything with your SPAM, I'd appreciate you doing what I did above and letting me use them for the Scam-O-Matic!

Thanks!

:)

Posted: Mon Jan 23, 2012 10:57 am

$1,000? you might want to up the ante if you want responses, expecting lads to work for a living is more expectation and less of reality, I'd offer $5K to $10K for their participation.
Having said that, you could always hint at a 'level 2' where they can go for the big bucks.

Master of Master Baiters Joined: 26 Sep 2008 Posts: 689

Having been involved with auto-responders for lad enjoyment I know there's a large time investment to start with but the payback in lad frustration and wasted time is well worth it. Care does have to be taken to eliminate baiters and ITP's from getting involved.

Posted: Mon Jan 23, 2012 3:08 pm

I would drop the photo requirement and anything else that makes it look like too much work. Also up the ante to $10,000 instead of $1,000. And all monthly winners are entered in the year-end sweepstakes for $1 Million.

To those who are lost - I think what he's trying to do is trick lads into baiting other lads under the guise of research. Cool

Posted: Mon Jan 23, 2012 4:03 pm

Looks that way.

Lets see how it goes!

Getting a bait over unity in terms of effort is a good thing, this could potentially tip the scales right over. Leveraging the powers of thousands of unwashed cafe bois is a fine thing.

Posted: Mon Jan 23, 2012 4:50 pm

Sounds interesting! How do you keep ITP or non-batible people like beggars out of the loop? I know your initial email says "you know they are a scammer" but would that stop a beggar I wonder?

I haven't seen what you put together but remember lads are lazy and if things seem too complicated they usually drop you pretty quick.

That said it's worth a shot let us know how it goes!

Not quite a Newb Joined: 30 Sep 2010 Posts: 45

bearkat419 wrote:

I would drop the photo requirement and anything else that makes it look like too much work. Also up the ante to $10,000 instead of $1,000. And all monthly winners are entered in the year-end sweepstakes for $1 Million.

Thanks for writing, @bearkat419 !

Hmm.. OK. I was trying to make them prove that they had gone past the templates for each scam. I'll make the pictures solely a bonus item.

bearkat419 wrote:

To those who are lost - I think what he's trying to do is trick lads into baiting other lads under the guise of research. 8)

You are exactly right! Anything in the name of research! ANd to be honest, there really is no tricking. That is the beauty of it. There is no secret to be discovered that blows it. I know you are a scammer, and you will be a victim for other scammers. All my cards are on the table, and I require no payments to me of any kind.

But the Scam-O-Matic is not a 1-time thing... Rather, an ongoing 'system' is how I guess you'd describe it. It should be fed automatically with emails, send out notices with rules & instructions, collect the lads' hard work, announce everyone a loser (individually, of course), rinse, lather, repeat-all with no baiter intervention. AND GD supplies really nice metrics on how much it is being used...

I can't make it unreasonable. $10,000 sounds like a LOT, but $5k sounds like a good amount at first, no? I'll increase the amount after I see participation of some kind. "Due to the overwhelming response...".

Also, I think I will tell them to pick just 3 emails to work on... Or do you think more is OK? Remember-they are just sending/receiving emails!

Google Docs is really a great tool for this. The scripting and forms were just MADE for this. One word of caution to those thinking of doing this; You should use a free 'Google Apps' account that has a private domain-one you've created especially for this. Mine is fablieaux.com, one of a few dozen domains I toy with. And contrary to popular belief, your IP address IS sent with your GMail posts. Mine are all automated, so there is no problem there. But even if they knew exactly where I was, why would they be mad at me? I'm trying to give them money, after all! :)

Once I automate the emails to the point where they are automatically putting the 'contest month' in, and I am culling and sending emails out automatically, I'll post the precise "How To" if anyone cares.

Like I said, the goal is to spend as little of my time on this as possible, while at the same time spending as much time on as many scammers as possible. I am slowly getting to where it will be 100% automated. Seeing as there are new scammers, and new scam SPAM all the time announcing themselves, I think it will just feed itself with fresh... researchers.

Keep the ideas coming! This is the result of all of your good ideas, so consider the Scam-O-Matic just as much your creation as mine!

:)

P.S. To catch a good researcher and get them involved, I need to weed through a lot of 'bad prospects', so I really do encourage as many people as possible to route your SPAM to my honeypot account as described above. Anyone who shouldn't get the email will just say "I'm not a scammer!" and delete it, so don't worry. One safe way would be to send me (using in:spam as described) all the emails your own honeypot accounts get. You know there are no legit emails there.

If I get 1 good researcher out of 100 or 200 SPAMs, then I need a lot of SPAM! ("Bloody Vikings!"), so your contributing your useless SPAM is a great help! PM me if you need more details...

Thanks, everyone for the continued ideas, support and suggestions!

Posted: Mon Jan 23, 2012 6:08 pm

Persius wrote:

And contrary to popular belief, your IP address IS sent with your GMail posts.

Just to clarify for those concerned:

Gmail, logged in via the web interface, will not show your IP.
Google Apps will show your IP.

But as always, don't take my word for it. Send emails to yourself and test what your IP shows from all your accounts. Very Happy

Not quite a Newb Joined: 30 Sep 2010 Posts: 45

bravo95 wrote:

Sounds interesting! How do you keep ITP or non-batible people like beggars out of the loop? I know your initial email says "you know they are a scammer" but would that stop a beggar I wonder?

@bravo95, why would I care who they are? (And I have no clue what an ITP is. I'd likely guess the 'good guys'... The good guys know they are not scammers, so the response does not apply. If anyone wanting to take the real scammers down wants some email addresses, I guess I could be convinced, but the bad guys pretend to be good guys all the time.

True, it is a wide net, but there are very few fish that we're looking for found in a lot of noise. The idea is to modify the messages and forms to avoid confusing the good guys, and convince as many bad guys to 'play' each month as possible.

bravo95 wrote:

I haven't seen what you put together but remember lads are lazy and if things seem too complicated they usually drop you pretty quick.

It's easy! Just send an email to Baba Ganoush @ fablieaux.com (remove spaces). If you aren't using your SPAM folder in gmail to harvest lads, please consider sending Baba a copy of each SPAM you get, as described above with a simple GMail Filter.

Thanks, all!

Posted: Mon Jan 23, 2012 7:26 pm

Persius wrote:

why would I care who they are? (And I have no clue what an ITP is. I'd likely guess the 'good guys'...

Why should you care? Cause we don't bait beggars or Innocent Third Parties (ITPs) http://forum.419eater.com/forum/viewtopic.php?p=1599532#1599532

Many times beggars and ITPs get caught up in our catcher accounts. Beggars seem like scammers, but they are only asking for money/things and not promising anything in return. And ITP email addies sometimes get in there because of various reasons (someone hitting Reply All instead of just Reply). There's more about it here in this sticky: http://forum.419eater.com/forum/viewtopic.php?t=198536 (I know you aren't talking about ASEMing, but the reasons for making sure you don't accidentally bait a ITP are the same.)

No one is saying your idea is bad -- it sounds promising. Just need to be sure that only the scammers are getting caught up in your system, which would be a concern with any automated system. Very Happy

Not quite a Newb Joined: 30 Sep 2010 Posts: 45

DoraTheExplorer wrote:

Persius wrote:

And contrary to popular belief, your IP address IS sent with your GMail posts.

Just to clarify for those concerned:

Gmail, logged in via the web interface, will not show your IP.
Google Apps will show your IP.

But as always, don't take my word for it. Send emails to yourself and test what your IP shows from all your accounts. :D

@DoraTheExplorer,

I Just tested this when I read a thread about it a few days ago. You have to be sure to send both outside & inside your provider. So, it's like 6 tests (at least) total:

Real IP? Test
NO GM -> GM
NO GM -> GM Apps
NO GM -> RW
YES GM Apps -> GM
YES GM Apps -> GM Apps
YES GM Apps -> RW

[note: This is all web interface, and not POP3/IMAP/API connectivity. Most people use the web.]

So my original tests were wrong, it seems. My apologies to @DoraTheExplorer, you are correct. I am too old for this 'facts' thing!

Now all of this changes all the time. To help me, I use FoxyProxy & Tor for my GMApps accounts. I don't care for my real one. And just in case someone decides to freak out about this, remember, this is just the IP address exposed to the real world. For most people, that is the address of your ISP's gateway. Most people don't even know where that is. Your connectivity method changes this location.

I have static IP addresses, so mine are easy to track-BUT they are still traceable only to my ISP's router. I don't want to start another thread, or repeat someone else's, so I am sorry moderators.

:)

Not quite a Newb Joined: 30 Sep 2010 Posts: 45

DoraTheExplorer wrote:

Why should you care? Cause we don't bait beggars or Innocent Third Parties (ITPs)

Well, if you look at the email being sent out, I clearly say at the start that I know they are a scammer. If someone isn't a scammer, they'd be turned off by it immediately. If anyone wants to fake like they are a scammer, then they are free to do so.

Baba Ganoush wrote:

"I know you are a scammer/419, and that is O.K.
I need scammers for my research, and I will pay you. "

You can read the full text any time by emailing BabaGanoush @ fablieaux.com (remove spaces... we don't want to give the lads anything to go by, now!)

Is that OK?

:)

Posted: Tue Jan 24, 2012 3:25 am

you could just write or ask for this thread to be moved to help, hints, and tips

Posted: Tue Jan 24, 2012 2:51 pm

Quote:

No one is saying your idea is bad -- it sounds promising. Just need to be sure that only the scammers are getting caught up in your system, which would be a concern with any automated system.

If someone gets a mail that says "I know you are a scammer" and "I'll give you a chance to win money for giving us information about your scamming" and decides to play along even if they aren't a scammer, then they aren't exactly an ITP in my opinion.

Posted: Tue Jan 24, 2012 3:50 pm

^^ Who said they are going to play along?

ITPs getting ASEMs from baiters was the whole reason for the sticky noted. ( http://forum.419eater.com/forum/viewtopic.php?t=198536 ) An ITP getting an email from the SCAM O MATIC is no different from an ASEM except it is automated.

I don't think mentioning the need for caution is out of line. That's all I am saying. Wink

Posted: Tue Jan 24, 2012 5:56 pm

^^ I agree, there is always a need for caution. But, maybe I'm misunderstanding, I thought the only people who would see anything from the scam-o-matic are those who first send something to it. Not exactly an ASEM.

Posted: Tue Jan 24, 2012 6:11 pm

OP said: "So I created a honeypot email account..."

Sounds like a catcher account? If so, then not every email in a catcher is 419 AFF. It's easy for other baiters and even the occassional ITP to get caught up in one.

If it's not a catcher and there is some way to know that all emails in the 'honeypot' are scammers, then there is no problem I can see and I have misunderstood.

Baiting Guru Joined: 03 May 2007 Posts: 18313

I understand Dora's concerns and think that the key to being careful with this is how you will get the scammer addresses who will be receiving the script.

Quote:

To catch a good researcher and get them involved, I need to weed through a lot of 'bad prospects', so I really do encourage as many people as possible to route your SPAM to my honeypot account as described above. Anyone who shouldn't get the email will just say "I'm not a scammer!" and delete it, so don't worry.

The way you've explained above will not eliminate beggars, whom we don't bait. Confirmed scammers will be those who have sent you a scam script.

Not quite a Newb Joined: 30 Sep 2010 Posts: 45

I am so grateful for all of you giving your input. I certainly don't know all the gotchas, and that is why I'm more open about it than secretive.

But I can do a lot more than create a blind auto-responder (which is what it is today). I can create unlimited filters that will look for key patterns in emails, and not just bounce every one back. So instead of just saying "It was sent to me", or "It was sent to me as SPAM (according to Google)", I can also filter (default = no email) so as to only send to those who have sent (or cc'd) emails with certain text/phrases. I say that text is better, because emails are constantly changing for a given lad.

Ima Baeder wrote:

I understand Dora's concerns and think that the key to being careful with this is how you will get the scammer addresses who will be receiving the script.

Quote:

To catch a good researcher and get them involved, I need to weed through a lot of 'bad prospects', so I really do encourage as many people as possible to route your SPAM to my honeypot account as described above. Anyone who shouldn't get the email will just say "I'm not a scammer!" and delete it, so don't worry.

The way you've explained above will not eliminate beggars, whom we don't bait. Confirmed scammers will be those who have sent you a scam script.

I agree completely. So now the question becomes how can I do it "right"?

Do I craft a list of terms manually, maintain them in a spreadsheet (better), GMail filters (cumbersome), or? Initially, I'm leaning toward a Google Docs form that allows me to simply enter in a text box the string (characters, including spaces) that would be a 'match'. My script then looks at all the entries in the spreadsheet the GD form creates for each email it processes, and determines whether it will get a registration request or not.

I'm in no rush, and there is no known specific event that will happen if I don't launch this, so I don't mind tweaking it as we go. In fact, any project like this is much more fun when more contribute.

So consider me the guy with the tools, and all of us as the ones with the ideas. If you can think it, odds are good that I can make it happen.

Thanks again for everyone contributing! It is much more interesting this way, no?

:)

Posted: Wed Jan 25, 2012 5:37 pm

You will want to filter for any bounce messages. If the lad has an account go dead, so your letter bounces, you want to kill any potential feedback loop. Kill anything with email damon or postmaster in the subject even if it includes your keyword.

Not quite a Newb Joined: 30 Sep 2010 Posts: 45

In addition to my earlier scripting to create the emails, this little tidbit from Google's API.

A worthy vehicle to mask a fun, yet productive, project.

:)

Posted: Thu Jan 26, 2012 7:53 pm

I understand how this is preventing scammers from using their time wisely, but doesn't this take the fun out of baiting for you? I LOVE baiting them just for the crap they say, and I think this just takes out the hilarity. Anyways, it is still a great idea, hopefully it works out.

Posted: Thu Jan 26, 2012 9:33 pm

^^^ I love the "funny" in the baits as well, but the overall goal is to waste thier time and rescources which Persius seems to have found a way to do. If I understand correctly his plan will be wasting the time of more lads than we can seriously bait at any given time. Where I have 8 ongoing baits at the moment I could probally handle a few more but not many. I recieve hundreds of scammers in my catcher on a weekly basis. What should I do with all of them as I can't realistically bait them all...so Persius's plan, after he has it in place, can take care of that for me/you/anyone who wants all the lads to suffer and not just the ones in a bait.

I give you... The Scam-O-Matic!	View next topic View previous topic