Author
Message
traxus
Greenhorn
Joined: 31 Jul 2004 Posts: 4
[SPOOF][EMAIL] New mail FROM ladybee777@hotmail.com I got mail from ladybee777...
please check the headers, help me decide if it's a hoax.
From: Princess <ladybee777@hotmail.com>
Date: Thu Jul 29, 2004 11:53:21 America/Montreal
To: traxusSPLAT bungie.org
Subject: aid
Return-Path: <ladybee777@hotmail.com>
Return-Path: ladybee777SPLAT hotmail.com
Received: from smtp-out5.blueyonder.co.uk (195.188.213. by bungie.org with ESMTP (Eudora Internet Mail Server 3.2.4) for <traxus@bungie.org>; Thu, 29 Jul 2004 11:53:25 -0400
Received: from [127.0.0.1] ([62.30.24.197]) by smtp-out5.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.6713); Thu, 29 Jul 2004 16:53:42 +0100
Message-Id: <41091D71.1010407@hotmail.com>
User-Agent: Mozilla Thunderbird 0.6 (Windows/20040502)
X-Accept-Language: en-us, en
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Originalarrivaltime: 29 Jul 2004 15:53:42.0453 (UTC) FILETIME=[38EEE650:01C47584]
I'm wanting http protocol.
mention project Gutenburg in one message.
love,
----
that was in reply to this message I sent:
From: Traxus <traxus@bungie.org>
Date: Thu Jul 29, 2004 03:27:22 America/Montreal
To: ladybee777SPLAT hotmail.com
Subject: a learning aid.
Mime-Version: 1.0 (Apple Message framework v553)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit
Message-Id: <BB639918-E130-11D8-ABFF-0030654D6414@bungie.org>
X-Mailer: Apple Mail (2.553)
I send this text as a vocabulary aid.
If you find this helpful and want similar data sets to parse, mention Project Gutenberg in one of your messages, and I'll send more.
If you can make use of the SMTP protocol, it will make these conversations much easier on all of us.
If you can make use of the HTTP protocol, you will find a wealth of information is available to you. A good starting point is: http://www.google.com
If you have no knowledge of these protocols, and would like technical information on how to make use of them, let us know.
*** here I included the full text of:
The Project Gutenberg eBook, History of Julius Caesar, by Jacob Abbott
http://www.gutenberg.net/1/1/6/8/11688/11688.txt
edited title to reflect analysis to date - AD
Posted: Sat Jul 31, 2004 9:57 am
traxus
Greenhorn
Joined: 31 Jul 2004 Posts: 4
In retrospect, telling it to reply through Email wasn't the most brilliant idea I've ever had... sorry guys..
Posted: Sat Jul 31, 2004 10:07 am
cpip
Veteran
Joined: 29 Jul 2004 Posts: 109 Location: KY
Just in case, I fired off to LadyBee a link to a book in Gutenberg and one of my preferred poems from it.
Maybe the entity controlling ladybee will find something useful she can tell us with "The Widow At Windsor."
Posted: Sat Jul 31, 2004 10:15 am
driz[z]jr
Guest
spelling of Gutenberg
Quote:
I'm wanting http protocol.
mention project Gutenbu rg in one message.
love,
What's with that U? Isn't the correct spelling Gutenberg?
I'm off to google.
Posted: Sat Jul 31, 2004 11:09 am
traxus
Greenhorn
Joined: 31 Jul 2004 Posts: 4
heh.. whoops... and I usually pride myself on my speling.
-edit-
oh wait, it wasn't MY mistake. it was HER mistake... hmm...
SPEC: maybe Dana's webserver has a faulty memory chip, 1 byte changes randomly, and that was the reason for the error?
I hope it doesn't cause the whole thing to crash.. with her off in China, there's no one to reboot the machine, we'd just sit here for months getting cannot connect to server errors...
Posted: Sat Jul 31, 2004 11:36 am
troy
Boot
Joined: 25 Jul 2004 Posts: 20 Location: Northeast Ohio
I'm thinkin this a hoaxy. First off, I would be surprised if ladybee stated IDing itself as Princess WITHOUT some major plot development.
Secondly, look at this transfer path
Code:
Received: from smtp-out5.blueyonder.co.uk (195.188.213.Cool by bungie.org with ESMTP (Eudora Internet Mail Server 3.2.4) for <traxus@bungie.org>; Thu, 29 Jul 2004 11:53:25 -0400
Received: from [127.0.0.1] ([62.30.24.197]) by smtp-out5.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.6713); Thu, 29 Jul 2004 16:53:42 +0100
This line makes me think it is a hoax. The path from the sender to you goes through servers at blueyonder.co.uk, not hotmail.
Secondly, the sender used Mozilla Thunderbird to send the message, not hotmail. It could just be that the PMs REALLY REALLY REALLY messed up, but I see no reason why a UK-based PM couldn't log in to Hotmail like the US-based ones.
Did you post your message on the Wiki or some other place where someone could read it and fabricate a response to it?
-Troy
[Edit: Added additional spec]
Posted: Sat Jul 31, 2004 11:45 am
traxus
Greenhorn
Joined: 31 Jul 2004 Posts: 4
Yeah, it certainly doesn't match the original ladybee email's headers at all.
Yes to the wiki posting.. I figured it would make it easier for everyone in case the reply was in a new killer.jpg... looks like my attempt to be helpful backfired.
Posted: Sat Jul 31, 2004 1:05 pm
-M-
Boot
Joined: 29 Jul 2004 Posts: 25
traxus wrote:
looks like my attempt to be helpful backfired.
Don't worry about it too much. about 90% of us are in the same boat. There hasn't exactly been much to be helpful with yet.
_________________HALT: SPORADIC POTENTIAL DATA REPETITION.
My boot will metastasize somewhere uncomfortable on all perpetrators.
Posted: Sat Jul 31, 2004 2:19 pm
Samari
Veteran
Joined: 25 Jul 2004 Posts: 72 Location: Notre Dame, IN
i highly doubt that one of The PM's is in England using dialup
even if they were, if it really were from ladybee, it would have passed through the hotmail servers and have the hotmail x-headers on it
Posted: Sat Jul 31, 2004 3:00 pm
Shad0
I Have No Life
Joined: 20 Jun 2004 Posts: 2180 Location: Southern California, USA
Re: [EMAIL] New mail FROM ladybee777@hotmail.com Stupid forum won't let me delete this! Help, Admins?
Posted: Sat Jul 31, 2004 3:10 pm
Last edited by Shad0 on Sat Jul 31, 2004 3:19 pm; edited 2 times in total
Shad0
I Have No Life
Joined: 20 Jun 2004 Posts: 2180 Location: Southern California, USA
Re: [EMAIL] New mail FROM ladybee777@hotmail.com
traxus wrote:
I got mail from ladybee777...
please check the headers, help me decide if it's a hoax.
From: Princess <ladybee777@hotmail.com>
Date: Thu Jul 29, 2004 11:53:21 America/Montreal
To: traxusSPLAT bungie.org
Subject: aid
Return-Path: <ladybee777@hotmail.com>
Return-Path: ladybee777SPLAT hotmail.com
Received: from smtp-out5.blueyonder.co.uk (195.188.213.8) by bungie.org with ESMTP (Eudora Internet Mail Server 3.2.4) for <traxus@bungie.org>; Thu, 29 Jul 2004 11:53:25 -0400
Received: from [127.0.0.1] ([62.30.24.197]) by smtp-out5.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.6713); Thu, 29 Jul 2004 16:53:42 +0100
Message-Id: <41091D71.1010407@hotmail.com>
User-Agent: Mozilla Thunderbird 0.6 (Windows/20040502)
X-Accept-Language: en-us, en
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Originalarrivaltime: 29 Jul 2004 15:53:42.0453 (UTC) FILETIME=[38EEE650:01C47584]
I'm wanting http protocol.
mention project Gutenburg in one message.
love,
A DNS reverse lookup of 62.30.24.197 gave the following information:
Code:
DNS Reverse Lookup Results
Host Type Value
197.24.30.62.in-addr.arpa PTR usr196-kno.blueyonder.co.uk
24.30.62.in-addr.arpa NS ns.blueyonder.co.uk
24.30.62.in-addr.arpa NS ns2.blueyonder.co.uk
ns.blueyonder.co.uk A 195.188.53.114
ns2.blueyonder.co.uk A 195.188.53.113
IP Address Contact Information
OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: Singel 258
Address: 1016 AB
City: Amsterdam
StateProv:
PostalCode:
Country: NL
ReferralServer: whois://whois.ripe.net:43
NetRange: 62.0.0.0 - 62.255.255.255
CIDR: 62.0.0.0/8
NetName: RIPE-C3
NetHandle: NET-62-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: NS2.NIC.FR
NameServer: SUNIC.SUNET.SE
NameServer: AUTH03.NS.UU.NET
NameServer: TINNIE.ARIN.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate: 1997-04-25
Updated: 2004-03-16
# ARIN WHOIS database, last updated 2004-07-30 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
So it didn't come through hotmail.com. The only other e-mail ostensibly from ladybee777 did come through hotmail.com, and had the following partial headers:
vpisteve wrote:
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 20 Jul 2004 06:07:24 -0700
Received: from 64.167.236.117 by by16fd.bay16.hotmail.msn.com with HTTP; Tue, 20 Jul 2004 13:07:24 GMT
And the "From" field didn't say "Princess":
vpisteve wrote:
From: "Margaret Efendi" <ladybee777@hotmail.com>
Between these discrepancies, the fact that the response doesn't quote your words directly but paraphrases, and the misspelling of "Guternberg," I'd agree that this is just another hoax.
(But was it in large green text?)
_________________These were the puzzles that would take a day, these were puzzles that would take a week, and these puzzles they'd probably never figure out until we broke down and gave them the answers. ... The Cloudmakers solved all of these puzzles on the first day.
Posted: Sat Jul 31, 2004 3:12 pm
cpip
Veteran
Joined: 29 Jul 2004 Posts: 109 Location: KY
Alas. I wasted an e-mail this time. (Or maybe not. Maybe the entity on the other end likes Kipling.)
Posted: Sat Jul 31, 2004 3:15 pm
Hayden2013
Guest
So does this mean someone has hacked her Hotmail and is now sending fake responses back to people? If not, then how did his e-mail get responded to with a fake e-mail when only he knew about it, and it was sent to the correct address?
Posted: Sat Jul 31, 2004 5:02 pm
Shad0
I Have No Life
Joined: 20 Jun 2004 Posts: 2180 Location: Southern California, USA
Re: [EMAIL] New mail FROM ladybee777@hotmail.com
Hayden2013 wrote:
So does this mean someone has hacked her Hotmail and is now sending fake responses back to people? If not, then how did his e-mail get responded to with a fake e-mail when only he knew about it, and it was sent to the correct address?
Traxus posted the outgoing e-mail to ladybee777SPLAT hotmail.com on the Wiki , so anybody could have seen it. Since the response doesn't actually appear to have come through hotmail.com, I don't think anyone has hacked Margaret's hotmail account.
Most likely, someone just thought it would be clever to spoof the headers and make it look like ilovebees777 was replying to Traxus. As you may perhaps have noticed, a lot of folks seem to take delight in perpetrating hoaxes against this ARG. :sigh:
_________________These were the puzzles that would take a day, these were puzzles that would take a week, and these puzzles they'd probably never figure out until we broke down and gave them the answers. ... The Cloudmakers solved all of these puzzles on the first day.
Posted: Sat Jul 31, 2004 5:10 pm
Hayden2013
Guest
I noticed that (people and hoaxes), but I hadn't raelized he had posted it on the Wiki.
Posted: Sat Jul 31, 2004 5:59 pm
Display posts from previous: All Posts 1 Day 1 Week 2 Weeks 1 Month 3 Months 6 Months 1 Year Sort by: Post Time Post Subject Author Ascending Descending