Return to Unfiction unforum
 a.r.g.b.b 
FAQ FAQ   Search Search 
 
Welcome!
New users, PLEASE read these forum guidelines. New posters, SEARCH before posting and read these rules before posting your killer new campaign. New players may also wish to peruse the ARG Player Tutorial.

All users must abide by the Terms of Service.
Website Restoration Project
This archiving project is a collaboration between Unfiction and Sean Stacey (SpaceBass), Brian Enigma (BrianEnigma), and Laura E. Hall (lehall) with
the Center for Immersive Arts.
Announcements
This is a static snapshot of the
Unfiction forums, as of
July 23, 2017.
This site is intended as an archive to chronicle the history of Alternate Reality Games.
 
The time now is Sun Nov 17, 2024 5:33 am
All times are UTC - 4 (DST in action)
View posts in this forum since last visit
View unanswered posts in this forum
Calendar
 Forum index » Archive » Archive: The Haunted Apiary (Let Op!) » The Haunted Apiary (Let Op!): Interaction
[SPOOF][EMAIL] New mail FROM ladybee777@hotmail.com
View previous topicView next topic
Page 1 of 2 [16 Posts]   Goto page: 1, 2 Next
Author Message
traxus
Greenhorn

Joined: 31 Jul 2004
Posts: 4

[SPOOF][EMAIL] New mail FROM ladybee777@hotmail.com

I got mail from ladybee777...

please check the headers, help me decide if it's a hoax.

From: Princess <ladybee777@hotmail.com>
Date: Thu Jul 29, 2004 11:53:21 America/Montreal
To: traxusSPLATbungie.org
Subject: aid
Return-Path: <ladybee777@hotmail.com>
Return-Path: ladybee777SPLAThotmail.com
Received: from smtp-out5.blueyonder.co.uk (195.188.213.Cool by bungie.org with ESMTP (Eudora Internet Mail Server 3.2.4) for <traxus@bungie.org>; Thu, 29 Jul 2004 11:53:25 -0400
Received: from [127.0.0.1] ([62.30.24.197]) by smtp-out5.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.6713); Thu, 29 Jul 2004 16:53:42 +0100
Message-Id: <41091D71.1010407@hotmail.com>
User-Agent: Mozilla Thunderbird 0.6 (Windows/20040502)
X-Accept-Language: en-us, en
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Originalarrivaltime: 29 Jul 2004 15:53:42.0453 (UTC) FILETIME=[38EEE650:01C47584]

I'm wanting http protocol.
mention project Gutenburg in one message.

love,



----

that was in reply to this message I sent:


From: Traxus <traxus@bungie.org>
Date: Thu Jul 29, 2004 03:27:22 America/Montreal
To: ladybee777SPLAThotmail.com
Subject: a learning aid.
Mime-Version: 1.0 (Apple Message framework v553)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit
Message-Id: <BB639918-E130-11D8-ABFF-0030654D6414@bungie.org>
X-Mailer: Apple Mail (2.553)

I send this text as a vocabulary aid.

If you find this helpful and want similar data sets to parse, mention Project Gutenberg in one of your messages, and I'll send more.

If you can make use of the SMTP protocol, it will make these conversations much easier on all of us.

If you can make use of the HTTP protocol, you will find a wealth of information is available to you. A good starting point is: http://www.google.com

If you have no knowledge of these protocols, and would like technical information on how to make use of them, let us know.


*** here I included the full text of:

The Project Gutenberg eBook, History of Julius Caesar, by Jacob Abbott
http://www.gutenberg.net/1/1/6/8/11688/11688.txt


edited title to reflect analysis to date - AD

PostPosted: Sat Jul 31, 2004 9:57 am
 View user's profile
 Back to top 
traxus
Greenhorn

Joined: 31 Jul 2004
Posts: 4

In retrospect, telling it to reply through Email wasn't the most brilliant idea I've ever had... sorry guys.. Razz

PostPosted: Sat Jul 31, 2004 10:07 am
 View user's profile
 Back to top 
cpip
Veteran

Joined: 29 Jul 2004
Posts: 109
Location: KY

Just in case, I fired off to LadyBee a link to a book in Gutenberg and one of my preferred poems from it.

Maybe the entity controlling ladybee will find something useful she can tell us with "The Widow At Windsor."

PostPosted: Sat Jul 31, 2004 10:15 am
 View user's profile AIM Address
 ICQ Number 
 Back to top 
driz[z]jr
Guest


spelling of Gutenberg

Quote:
I'm wanting http protocol.
mention project Gutenburg in one message.

love,


What's with that U? Isn't the correct spelling Gutenberg?
I'm off to google. Smile

PostPosted: Sat Jul 31, 2004 11:09 am
 Back to top 
traxus
Greenhorn

Joined: 31 Jul 2004
Posts: 4

heh.. whoops... and I usually pride myself on my speling. Wink

-edit-
oh wait, it wasn't MY mistake. it was HER mistake... hmm...

SPEC: maybe Dana's webserver has a faulty memory chip, 1 byte changes randomly, and that was the reason for the error?

I hope it doesn't cause the whole thing to crash.. with her off in China, there's no one to reboot the machine, we'd just sit here for months getting cannot connect to server errors...

Razz

PostPosted: Sat Jul 31, 2004 11:36 am
 View user's profile
 Back to top 
troy
Boot

Joined: 25 Jul 2004
Posts: 20
Location: Northeast Ohio

I'm thinkin this a hoaxy. First off, I would be surprised if ladybee stated IDing itself as Princess WITHOUT some major plot development.

Secondly, look at this transfer path

Code:

Received: from smtp-out5.blueyonder.co.uk (195.188.213.Cool by bungie.org with ESMTP (Eudora Internet Mail Server 3.2.4) for <traxus@bungie.org>; Thu, 29 Jul 2004 11:53:25 -0400
Received: from [127.0.0.1] ([62.30.24.197]) by smtp-out5.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.6713); Thu, 29 Jul 2004 16:53:42 +0100


This line makes me think it is a hoax. The path from the sender to you goes through servers at blueyonder.co.uk, not hotmail.

Secondly, the sender used Mozilla Thunderbird to send the message, not hotmail. It could just be that the PMs REALLY REALLY REALLY messed up, but I see no reason why a UK-based PM couldn't log in to Hotmail like the US-based ones.

Did you post your message on the Wiki or some other place where someone could read it and fabricate a response to it?

-Troy

[Edit: Added additional spec]

PostPosted: Sat Jul 31, 2004 11:45 am
 View user's profile
 Back to top 
traxus
Greenhorn

Joined: 31 Jul 2004
Posts: 4

Yeah, it certainly doesn't match the original ladybee email's headers at all.

Yes to the wiki posting.. I figured it would make it easier for everyone in case the reply was in a new killer.jpg... looks like my attempt to be helpful backfired.

PostPosted: Sat Jul 31, 2004 1:05 pm
 View user's profile
 Back to top 
-M-
Boot


Joined: 29 Jul 2004
Posts: 25

traxus wrote:
looks like my attempt to be helpful backfired.


Don't worry about it too much. about 90% of us are in the same boat. There hasn't exactly been much to be helpful with yet. Sad
_________________
HALT: SPORADIC POTENTIAL DATA REPETITION.

My boot will metastasize somewhere uncomfortable on all perpetrators.


PostPosted: Sat Jul 31, 2004 2:19 pm
 View user's profile
 Back to top 
Samari
Veteran


Joined: 25 Jul 2004
Posts: 72
Location: Notre Dame, IN

i highly doubt that one of The PM's is in England using dialup

even if they were, if it really were from ladybee, it would have passed through the hotmail servers and have the hotmail x-headers on it

PostPosted: Sat Jul 31, 2004 3:00 pm
 View user's profile AIM Address MSN Messenger
 Back to top 
Shad0
I Have No Life


Joined: 20 Jun 2004
Posts: 2180
Location: Southern California, USA

Re: [EMAIL] New mail FROM ladybee777@hotmail.com

Stupid Cursing forum won't let me delete this! Help, Admins?

PostPosted: Sat Jul 31, 2004 3:10 pm
Last edited by Shad0 on Sat Jul 31, 2004 3:19 pm; edited 2 times in total
 View user's profile
 Back to top 
Shad0
I Have No Life


Joined: 20 Jun 2004
Posts: 2180
Location: Southern California, USA

Re: [EMAIL] New mail FROM ladybee777@hotmail.com

traxus wrote:
I got mail from ladybee777...

please check the headers, help me decide if it's a hoax.

From: Princess <ladybee777@hotmail.com>
Date: Thu Jul 29, 2004 11:53:21 America/Montreal
To: traxusSPLATbungie.org
Subject: aid
Return-Path: <ladybee777@hotmail.com>
Return-Path: ladybee777SPLAThotmail.com
Received: from smtp-out5.blueyonder.co.uk (195.188.213.8) by bungie.org with ESMTP (Eudora Internet Mail Server 3.2.4) for <traxus@bungie.org>; Thu, 29 Jul 2004 11:53:25 -0400
Received: from [127.0.0.1] ([62.30.24.197]) by smtp-out5.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.6713); Thu, 29 Jul 2004 16:53:42 +0100
Message-Id: <41091D71.1010407@hotmail.com>
User-Agent: Mozilla Thunderbird 0.6 (Windows/20040502)
X-Accept-Language: en-us, en
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Originalarrivaltime: 29 Jul 2004 15:53:42.0453 (UTC) FILETIME=[38EEE650:01C47584]

I'm wanting http protocol.
mention project Gutenburg in one message.

love,

A DNS reverse lookup of 62.30.24.197 gave the following information:

Code:
DNS Reverse Lookup Results
Host               Type   Value
197.24.30.62.in-addr.arpa   PTR   usr196-kno.blueyonder.co.uk
24.30.62.in-addr.arpa      NS   ns.blueyonder.co.uk
24.30.62.in-addr.arpa      NS   ns2.blueyonder.co.uk
ns.blueyonder.co.uk      A   195.188.53.114
ns2.blueyonder.co.uk      A   195.188.53.113
IP Address Contact Information

OrgName:    RIPE Network Coordination Centre
OrgID:      RIPE
Address:    Singel 258
Address:    1016 AB
City:       Amsterdam
StateProv: 
PostalCode:
Country:    NL

ReferralServer: whois://whois.ripe.net:43

NetRange:   62.0.0.0 - 62.255.255.255
CIDR:       62.0.0.0/8
NetName:    RIPE-C3
NetHandle:  NET-62-0-0-0-1
Parent:     
NetType:    Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: NS2.NIC.FR
NameServer: SUNIC.SUNET.SE
NameServer: AUTH03.NS.UU.NET
NameServer: TINNIE.ARIN.NET
Comment:    These addresses have been further assigned to users in
Comment:    the RIPE NCC region. Contact information can be found in
Comment:    the RIPE database at http://www.ripe.net/whois
RegDate:    1997-04-25
Updated:    2004-03-16

# ARIN WHOIS database, last updated 2004-07-30 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

So it didn't come through hotmail.com. The only other e-mail ostensibly from ladybee777 did come through hotmail.com, and had the following partial headers:

vpisteve wrote:
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 20 Jul 2004 06:07:24 -0700
Received: from 64.167.236.117 by by16fd.bay16.hotmail.msn.com with HTTP; Tue, 20 Jul 2004 13:07:24 GMT

And the "From" field didn't say "Princess":

vpisteve wrote:
From: "Margaret Efendi" <ladybee777@hotmail.com>

Between these discrepancies, the fact that the response doesn't quote your words directly but paraphrases, and the misspelling of "Guternberg," I'd agree that this is just another hoax.

(But was it in large green text?)
_________________
These were the puzzles that would take a day, these were puzzles that would take a week, and these puzzles they'd probably never figure out until we broke down and gave them the answers. ... The Cloudmakers solved all of these puzzles on the first day.

PostPosted: Sat Jul 31, 2004 3:12 pm
 View user's profile
 Back to top 
cpip
Veteran

Joined: 29 Jul 2004
Posts: 109
Location: KY

Alas. I wasted an e-mail this time. (Or maybe not. Maybe the entity on the other end likes Kipling.)

PostPosted: Sat Jul 31, 2004 3:15 pm
 View user's profile AIM Address
 ICQ Number 
 Back to top 
Hayden2013
Guest


So does this mean someone has hacked her Hotmail and is now sending fake responses back to people? If not, then how did his e-mail get responded to with a fake e-mail when only he knew about it, and it was sent to the correct address?

PostPosted: Sat Jul 31, 2004 5:02 pm
 Back to top 
Shad0
I Have No Life


Joined: 20 Jun 2004
Posts: 2180
Location: Southern California, USA

Re: [EMAIL] New mail FROM ladybee777@hotmail.com

Hayden2013 wrote:
So does this mean someone has hacked her Hotmail and is now sending fake responses back to people? If not, then how did his e-mail get responded to with a fake e-mail when only he knew about it, and it was sent to the correct address?

Traxus posted the outgoing e-mail to ladybee777SPLAThotmail.com on the Wiki, so anybody could have seen it. Since the response doesn't actually appear to have come through hotmail.com, I don't think anyone has hacked Margaret's hotmail account.

Most likely, someone just thought it would be clever to spoof the headers and make it look like ilovebees777 was replying to Traxus. As you may perhaps have noticed, a lot of folks seem to take delight in perpetrating hoaxes against this ARG. :sigh:
_________________
These were the puzzles that would take a day, these were puzzles that would take a week, and these puzzles they'd probably never figure out until we broke down and gave them the answers. ... The Cloudmakers solved all of these puzzles on the first day.

PostPosted: Sat Jul 31, 2004 5:10 pm
 View user's profile
 Back to top 
Hayden2013
Guest


I noticed that (people and hoaxes), but I hadn't raelized he had posted it on the Wiki.

PostPosted: Sat Jul 31, 2004 5:59 pm
 Back to top 
Display posts from previous:   Sort by:   
Page 1 of 2 [16 Posts]   Goto page: 1, 2 Next
View previous topicView next topic
 Forum index » Archive » Archive: The Haunted Apiary (Let Op!) » The Haunted Apiary (Let Op!): Interaction
Jump to:  

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
You cannot post calendar events in this forum



Powered by phpBB © 2001, 2005 phpBB Group