|
|
Chaos Project #1 |
Thread 1 |
Mr. Momodu Meets The Mob |
Below you will find recorded the history of The Chaos Project's relationship with Mr. Shaka Momodu, an unfortunate young orphan who desperately needed our assistance to claim 25.5 million dollars from his dead father's bank account. Unfortunately, (and we don't know how this happened), he seemed to get the impression that we are a New Jersey resident named Robert Urich (1), and that we work for a heavy machinery manufacturing company (2). As the conversation went on, painfully obvious hints were dropped that we have strong Mafia connections (3), a fact which eluded the touchingly trusting Mr. Momodu Junior for almost three weeks. Finally, however, he grasped the clues, and we did indeed seem to have him firmly convinced that he was dealing with a member of one of New Jersey's leading crime families.
(1) Which we aren't
(2) Which we don't
(3) Which we do. No, wait, we mean ...
|
First sighting--a flash in the stream: Mr. Momodu's return address tells us that he is making use of "caramail.com", which appears to be a free, French-language-only, web-based email service owned by Lycos. However, a little analysis of the information provided by the email headers, along with the log of the message's arrival at our in-house mail server, strongly suggested that the original email did not come from caramail, but was probably relayed through an open mail server that was hijacked for the purpose of sending out an unknown (but probably very large) number of these initiatory approaches. [ Later research suggested that this wasn't an open relay at all, but simply a dedicated 'spam engine' operating in Nigeria through an Internet connection fed by an international satellite provider. ] |
From: "SHAKA" <shakamomodu@caramail.com>
Dear Sir,I hope this email meets you well, My late father left with me |
|
The hook goes into the water... First response sent to scammer 24/9/02 6:44 PM. Careful not to come on too strong--we don't want to tip him off! A subtle change was made to the email address in the .sig--although the original email was sent to a country-code-specific address, this response was sent from a matching .com address which also reaches the same destination. This was done so that we could (grossly) misrepresent our actual geographical location. If all goes well, the reasons behind this choice of virtual residence will eventually become clear :-) If Mr. Momodu has a legitimate reason for using a French-language-only mail provider (many Africans do speak French as their first language, after all), then he would do well to take note of the .sig quote: "Perfection is achieved not when nothing more can be added, but when nothing more can be taken away." We think it's safe to assume that his perfect goal is to reach a state where nothing more can be taken away from us... |
Ha! What is this, some kind of a joke? Is that you, Vinnie? |
|
A tug on the thread ... has he taken the bait? This first response appears to be somewhat boilerplate, but it does come from a caramail server, suggesting that there is some actual human involvement here. Perhaps the first sentence has been tacked onto the front of a standard response. The mention of "cannot access a foreign account" is interesting. What is his plan here? www.ecobank.com has a reasonably convincing front page, but a quick google search on "ecobank nigerian scam" yielded plenty of interesting hits ... some further research is definitely called for. It's interesting to note here that Shaka's originating IP address is from a block belonging to a German company, some sort of satellite telecommunications provider/ISP or similar: kbimpulse.com. Is this address simply part of a smaller block that they have allocated to some untracable ISP? Or is it perhaps an open proxy? Most intriguing of all is the implication in this report that our friend Shaka may (for example) actually be in Germany, perhaps German himself, accepting rerouted calls from Nigeria, and faking his atrocious English in order to make us think he's a bit light in the ol' brain department. (N.B. This I.P. address was later found listed [in an spfilter.openrbl.org list cached at google--yay for google] as an "actively exploited open proxy" on August 22. This would suggest that it is just a German host they are using to hide themselves. Their emails generally have a time offset of GMT+1, which is right for Lagos, but Germany would be GMT+2) (Later again, evidence was found that suggested that this proxy may actually belong to an African ISP. Perhaps it is simply the proxy that they use automatically through their ISP; we may have given them too much credit for techincal skill :-) |
From: shaka momodu <shakamomodu@caramail.com> I am sorry but this is very serious business. |
|
A gentle pull on the line ... can we hook our fish? Here we start to really develop our character's backstory. Perhaps we're laying it on a bit thick, and he will catch on, but time will tell... BTW, do you have any idea how hard it is for typographical pedants like us to make so many mistakes? |
Wo, dude, so you'se a real person after all? Holy motherf... |
|
The line goes taught--the bait has been taken! Game on! Right off the mark, we are faced with some challeneges, however. Our friend Mr Momodu apparently wants us to physically mail this incredibly convincing letter, presumably including a legitimate return mailing address where we will receive further instructions. A little difficult, as we are of course not actually in New Jersey as claimed. We are also unwilling to give him any real, traceable personal information. But perhaps we're mistaken: the physical address he provides is a little short on detail "West Africa"??? Perhaps he does in fact intend for us to simply email this letter. Clarification is obviously required, which is of course an opportunity to spin out the conversation a little further... PS Interesting to note that the infamous Mr Sanni Abacha has made his appearance in this letter. PPS "nice to have you"??? I dont think so, Mr. Momodu :-) |
From: "shaka momodu" <shakamomodu@caramail.com> Robert, |
|
OK, so let's drop the lame fishing metaphors now and just get on with things.
And no, we haven't forgotten that the "dead dude" is supposed to be our new friend Shaka's father, we just want to see how he reacts to our callousness :-) |
Date: Wed, 2 Oct 2002 22:19:57 -0700 (PDT) Shaka my man, |
|
Hmm. Callousness ignored, along with the racial slur, the mafia assassination allusion, and the question about Sanni Abacha. We think it might be appropriate for Mr. Urich to indicate a slight degree of dissatisfaction on that last point... |
From: "shaka momodu" <shakamomodu@caramail.com> Dear robert, |
|
So, to show good faith, we first send the letter, as requested, to 'ecobank', who apparently like to receive important mail like this in American Samoa (as indicated by the ".as" country code in the email address). Just the top of it is reproduced here, as only minimal editing was required thanks to Mr. Momodu helpfully inserting Bobby's surname in all (well, most) of the relevant places. Note the address well: 308 and 520 are simple variations on '419', a la HAL/IBM. Frazen Baker is of course a spoonerism, and the street name runs a serious risk of tipping them off if they say it out loud :-) |
Name:………Robert Urich |
|
And then we continue the discussion with our good friend Shaka.
Incidentally, if you are totally devoid of a sense of humour then you probably won't have made it this far. But just in case: the first comment in the message to the right is of course a joke. It's parody of xenophobic ignorance, OK? Get over it. Hopefully our new friend is not too upset by our gentle criticism. We wouldn't want to offend a poor suffering orphan (sob, sob!) And how hypocritical of us to complain about his failure to answer our question, when we have ignored his request for a 'phone number twice now. And will of course continue to do so for as long as possible...
Concerning the MGF: the fraudsters apparently use the word "mgbada" to refer to their victims (we gather it's a highly offensive expression). An extra 10 points, we think, if we can introduce that phrase into the discusson without tipping him off :-) |
Date: Thu, 3 Oct 2002 22:28:32 -0700 (PDT) Hey Shaka dude, |
|
... and a scant six and a half hours later, we receive a terrifically official-looking response from 'ecobank.' This reponse includes a 122k 'application form' in TIFF format. Mr. Adewale has also helpfully supplied a link to the ecobank website. Funny, that doesn't look like the address we found by ourselves the other day (http://www.ecobank.com). Plus, the content doesn't look quite as professional or complete. And to cap it all off, the website of this leading African financial powerhouse seems to be hosted at ... a free web-hosting provider in Surrey, England. How curious. Perhaps a cost-saving venture. (Note to selves: drop a line ASAP to port5.com advising them to pull the plug on this site before somebody really gets fleeced. We're sure Mr. Adewale will be able to find a convincing explanation if we bother to ask him why his website is no longer available.) This message is followed closely by ... |
From: "Ecobank Private Banking Plc" <ecobank@customerservice.inbox.as>
Mr. Robert Urich |
|
... an almost identical letter, albeit this time with an application form attached as a 374k JPEG image. Both letters are signed by the same Mr. Adewale, so we're at a loss to understand why he would send two different forms, and--from a quick glance at the headers--via two entirely different mail services. If it was a case of two entirely different people accidentally responding separately to the same 'opportunity', that would be understandable... Hmmm. We wonder if NamePlanet is a customer of 'ecobank'? That would be one explanation for their advertisement appearing at the bottom of the very formal and official message from the bank. On the other hand, it almost looks like ... but no, surely a big financial institution like ecobank wouldn't be using a free, advertising-funded email service, would they? |
From: ecobank@customerservice.inbox.as
Mr. Robert Urich |
|
Ah.... We think now we're starting to get Mr. Momodu's attention. In response to our little complaint, he's taken the time to clear up the matter of the name at the end of the letter. "Nickname," he says, and yet we seem to hear a voice somewhere saying "Oh, fiddlesticks, I though when I modifed the standard 'Sanni Abacha' scam letter, I had changed all the instances of his name to 'Momodu'. How the Dickens did I miss that one? I could kick myself..." etc. We notice that he's supplied a telephone number where we can reach him, and helpful instructions for dialling from the USA. A quick glance through the ISD section of the 'phone book tells me that his area code is for ... Lagos, Nigeria. Well, what a surprise! Oh, and look, he's started calling Bobby "partner." Ain't that reassuring? |
From: "shaka momodu" <shakamomodu@caramail.com>
Partner, |
|
In the real world, we're going to be unavailable for a couple of days, so we dash off a quick message to reassure our new friend Shaka, in case he wonders why there's no communication from Bobby on (New Jersey's) Friday, and also to feed his character development. |
Date: Fri, 4 Oct 2002 06:28:35 -0700 (PDT)
Ciao Shaka my partner and compadre, |
|
... and a nice friendly response. Doesn't he sound pleased with us? :-) And now he's calling us friend. That's so sweet! |
From: "shaka momodu"
<shakamomodu@caramail.com>
friend, |
|
Last thing Sunday night/Monday morning, we made repeated attempts to contact port5.com (or portland.co.uk, as it turned out), to ask them to take down the fake ecobank website. abuse@port5.com doesn't exist, nor webmaster@port5.com, nor webmaster@portland.co.uk. To the right you see the closest we got to success, and I think we can all see that we weren't likely to get much further with this line of enquiry :-) On Monday we took another brief look at the fake ecobank website. There's not a whole lot there, for obvious reasons, but one page has an account number/password form to "check your account balance." This was a screamer: the HTML source code behind it referred to a javascript function which, in the simplest coding possible, spelled out the two (and only two) account number/password combinations that it would accept. With the first account number (which happens to be the one that Shaka mentioned early in our discussion), and the fantastically secure password "123", a little window came up to tell us that the account balance was ... wait for it ... $25.5 million dollars. Does that figure sound familiar? We think it does! But here's the real kicker: the second ac/pw combination showed a blance of $113.5 million! What's going on here? Somebody is set to make a whole lot more money than us, and frankly we don't think that's fair! :-) :-) |
X-Failed-Recipients: abuse@mail.portland.co.uk
This message was created automatically by mail delivery software |
|
OK, so we've reached late Sunday night, NJ time (we're being a little more careful about the time zones now). The 'ecobank' Next of Kin form was very confusing in the information it asked for (rather a clever touch of authenticity on their part, we thought :-), so we first send off a message to our friendly 'ecobank' contact asking for clarification... |
Date: Sun, 6 Oct 2002 21:23:04 -0700 (PDT)
Dear Mr. Adewale. |
|
... and follow that with a message to our good friend Shaka to make sure he's kept informed. |
Date: Sun, 6 Oct 2002 21:33:32 -0700 (PDT) Ciao, my good friend Shaka |
|
We receive a response from Shaka first, gently encouraging us down the path of opening an account at 'ecobank'. How tempting to avoid all that form-filling... |
Mon, 7 Oct 2002 17:50:18 +0200 (DST) dear friend, |
|
What a consummate professional Mr. Adewale is! A wonderfully helpful response answering all our questions. This fills us with confidence, and we will be completing the form and sending it back to him very shortly. |
From: ecobank@customerservice.inbox.as Robert Urich. |
|
The next 'night' (around 10:00 PM N.J. time, around 3:00AM Nigeria time, around 4:00 AM Germany time), we send back the all-important N.O.K. application form: (We take the opportunity to have a subtle dig at Shaka here for not answering our questions. We're assuming he is Mr. Adewale as well, or is at least seeing copies.) |
Date: Mon, 7 Oct 2002 19:06:13 -0700 (PDT) Dear Mr. Adewale, |
|
And of course we let Shaka know that things are progressing well. We're pressing the Mafia angle hard here for a number of reasons. One is to prepare him for the idea that bank transfers won't be an option for us ("Because of government snooping, we're strictly a cash transaction type of operation"). Plus we're having fun toying with him :-) |
Date: Mon, 7 Oct 2002 20:09:38 -0700 (PDT) Hey Shaka, paysanne, |
|
Oh dear. For the first time, we have had no response overnight. Has he caught on? Has he seen through our subtle subterfuge? Is this the last we will hear of Mr. Momodu? Meanwhile, late last night we checked the street address for the Lagos branch of ecobank as given on the fake ecobank web site. The real ecobank web site doesn't list a branch at that address, so there is a small chance that this address really does house Mr. Momodu, or some part of his operation. Searching on the street name revealed that the address in question is just a few doors away from the Irish Embassy in Lagos. Hmmmm. Couldn't track down an email address for the embassy (no doubt there's a good reason for that not being published :-), so we wrote a polite request to an Irish consul in our own country, asking him to pass on a request for any information about what is really at 22 Kofo Abayomi Street, Lagos. No response by lunchtime the next day, but we shall wait and see... |
|
|
Oh dear. A second consecutive night with no email from our Nigerian friends. This does not look good. Time to try and wake them up again. Consulting the 'ecobank' web site at intervals of some hours did reveal that they are still alive - some subtle changes in the underlying scripts show that they have been experimenting. |
Date: Wed, 9 Oct 2002 17:13:25 -0700 (PDT) Dear Mr. Adewale |
|
Oops - our Yahoo! "sent mail" box tells us that we sent this message twice. Not necessarily a bad thing--Bobby Urich isn't exactly a master of Internet technology, so this will just help to lend authenticity :-) |
Date: Wed, 9 Oct 2002 17:30:21 -0700 (PDT) Hello my friend Shaka, |
|
Hoorah! We are back in the game, with responses overnight from 'both' Messrs. Adewale and Momodu. We have to say we're none too impressed with Mr. Adewale's tone here. "Either You open Foreign account with us or ...". Harrumph. Perhaps we'll take our business elsewhere! |
From: ecobank@customerservice.inbox.as Robert Urich, |
|
From: "shaka momodu" <shakamomodu@caramail.com> dear friend, |
|
|
Ummmm.... gee, Shaka, that's not the number you gave us last time ... When we get around to checking this number, the boys from 'ecobank' have removed the JavaScript account number/password checking again, and all numbers are passed through to a PHP form. Presumably they are checked there. Why the new number? Are they attracting more 'clients'? |
From: "shaka momodu" <shakamomodu@caramail.com> friend, |
|
Yeah, well,we were going to get tough with him about his attitude, but instead decided to just play it a bit sniffy. The fax number goes to a free e-fax service that should theoretically forward any faxes it receives to our email. The area code is for Ohio--you have to pay actual money to get an area code near you are (well, near where you're supposed to be :-). We sure hope this little inconsistency doesn't ring any alarm bells with Mr. Momodu's impressive powers of observation and deduction. |
Date: Thu, 10 Oct 2002 19:07:53 -0700 (PDT) Mr. Adewale, |
|
Y'know, not only is this fun, it's also educational. Look at all the Italian we're learning: figlio di puttana - son of a whore pezzi di merda - pieces of sh*t consiglieri - mafia counsel/advisor, e.g. Tom Hagen, the character played by Robert Duvall in The Godfather |
Date: Thu, 10 Oct 2002 19:55:38 -0700 (PDT) Hey Shaka my very good friend |
|
Aha! Finally, we start getting to the point. Mr Adewale doesn't seem interested in the fax number. Of course, he never would be: the whole point of this exchange is to get Bobby to send them money, after all. What he thinks Bobby should do (surprise surprise) is send him a whole bunch of money! Gosh darn, we didn't see that one coming. Hmmmm. He wants a photo. That gives us an idea ... |
From:ecobank@customerservice.inbox.as Robert Urich, |
|
First, we open the door to the possibility that we might be willing to open a foreign account... |
Date:Sun, 13 Oct 2002 17:43:11 -0700 (PDT) Dear Mr. Adewale, |
|
... then, we 'secretly' start to confide our real plan to Shaka. Ha ha, we're just lying to that nasty Mr. Adewale! Shaka is our real friend. At this point, we like to think of little Shaka's eyes lighting up with glee at the unexpected revelation of large wads of untraceable cash, unasked-for bribes, etc. If it all seems a little unlikely, take a look back at some of the outrageous comments from us that he has already breezily ignored. Mr. Momodu may think that we am well and truly hooked now, but we think that this is the absolutely crucial turning point in this relationship: action, or at least agreement to action on his part is now required, and if he responds positively at this point, then it can only be because it is he who is now the willing believer being led eagerly down the garden path. |
Date:Sun, 13 Oct 2002 18:28:52 -0700 (PDT) Hey shaka dude, |
|
Nothing overnight. Knuckle-biting, hand-wringing. Have we gone too far this time? |
|
|
It would seem we have not :-) Curiously, as with the delivery of the previous form from 'ecobank', we got two almost identical copies of this message, one with a TIF copy of the form, and one with a JPEG. They appear to have come from the same workstaion, just under two minutes apart. |
From:ecobank@customerservice.inbox.as Mr. Robert Urich |
|
Somewhere deep in Africa, a tiny little light bulb has just gone "plink" over a scammer's head. Interesting to note the different originating IP. This one resolves to: 66-178-46-228.reverse.newskies.net Presumably just another African ISP address. Our best guess is that Shaka has simply wandered into a different Internet Café today. |
From:"shaka momodu" <shakamomodu@caramail.com> Robert, |
|
Time to turn up the heat, we think. Let's start with a little retort from Bobby: |
Date:Tue, 15 Oct 2002 16:46:53 -0700 (PDT) YO YO YO, Shaka, my little African friend, |
|
Next, as Bobby is working through his correspondence for the evening, he dashes off a note to the bank... |
Date:Tue, 15 Oct 2002 16:52:26 -0700 (PDT) Mr. Adewale, |
|
... which reminds him that he still needs to know where Shaka is: |
Date:Tue, 15 Oct 2002 16:56:57 -0700 (PDT) Hey Shaka my friend, |
|
After a believable interval, we follow up with Shaka's first direct contact from the formidable Luigi: |
Date:Tue, 15 Oct 2002 17:28:14 -0700 (PDT) Dear Mr. Momodu, |
|
Just MINUTES later, we receive this extremely gratifying response! |
From:"shaka momodu" <shakamomodu@caramail.com> Dear friend, |
|
And three minutes later, an abject apology to Luigi, of whom he is clearly even more scared than he is of Bobby. Well hey, at least Luigi can spell :-) We'll let him sweat it out a day or so now. Perhaps that will encourage him to send in the photo. |
From:"shaka momodu" <shakamomodu@caramail.com> Luigi Bonaventura |
|
This arrives just the very next day. He doesn't sound worried enough to us. We think we'll make him wait a little longer ... |
From:"shaka momodu" <shakamomodu@caramail.com> Dear robert, |
|
That's more like it! Now we have him concerned. He seems to be having second thoughts about receiving great wads of cash from us, though. Odd. |
From:"shaka momodu" <shakamomodu@caramail.com> Dear friend, |
|
OK, time to re-open the conversation with our worried little friend. "Hurry up" is a phrase he has used in other threads. |
Date:Sat, 19 Oct 2002 13:24:26 -0700 (PDT) Hey, Shaka, my little compadre, |
|
Hmmm. Even less keen on the ol' parcel full o' money business. Yet another name offered for a Western Union transfer, though. |
From:"shaka momodu" <shakamomodu@caramail.com> Dear friend, |
|
And, finally, here he is, in all his corn-fed glory. Obviously, this won't be our actual friend, but what the hell, it lets us put a face to the name. Can you guess into which folder Yahoo!, in its infinite wisdom, automatically directed this particular message? Yes, that's right, Bulk Mail! :-) :-) That's hilarious on so many levels. You can click on the image at right to see the full original file, but beware, it's a fantastically unnecessary 454k in size, and doesn't look any better than what you see here. We think he must have scanned a photocopy of a photocopy of a newspaper photo of a billboard of a bad photo. And then messed it up a bit in Photoshop for good measure. |
From: "shaka momodu" <shakamomodu@caramail.com> MY PHOTO.
|
|
Oh dear, seems we've been neglecting our young friend. We had better remedy that soon. |
From:"shaka momodu" <shakamomodu@caramail.com> partner, |
|
When he gets into the 'office' in the morning, Shaka will finally get to see a picture of Bobby. Except, of course, that the young man in these photos is in fact actor Michael Imperioli, who plays the character Christopher Moltisanti in the award-winning T.V. show "The Sopranos". The mugshot comes originally from HBO; we sourced it from a Sopranos fan site. The dapper gentleman in the dinner suit is Mr. Joe Amato, a professional entertainer and Sinatra impersonator. We found the photo of him with Michael Imperioli on his website. |
Date:Wed, 23 Oct 2002 20:22:34 -0700 (PDT) Heeeey, Shaka, take it easy my little friend. Where's
|
|
Hey, apparently Luigi and Bobby look "cool"! |
From: "shaka momodu" <shakamomodu@caramail.com> Dear robert, |
|
Bobby continues to struggle with the spelling of "itinerary". Rich foreigner arriving at Lagos airport laden with gifts and CASH--surely a scammer's dream? Of course, there is that business of him being in the Mafia ... |
Date: Sat, 26 Oct 2002 14:26:05 -0700 (PDT) Yo, my chunky compadre, |
|
Now it's Bobby who's getting impatient. And when you're dealing with a core member of one of New Jersey's biggest crime families, you really don't want to make him impatient :-) Shaka's silence is interesting, as he wrote to all of our other identities on the morning of October 28. What did Bobby do wrong? :-( |
From Robert urich Mon Oct 28 18:48:46 2002 Hey Shaka, my portly pal, |
|
Aha! A meeting is being arranged at last. Now, we wonder how many webcams there are in Accra? :-) |
From: "shaka momodu" <shakamomodu@caramail.com> I was arranging where we could meet that will be safe for |
|
Well, we couldn't find any working webcams in Accra, so we're going to go for the old 'Make the scammer wait in the airport holding a humiliating sign with a thinly-veiled insult written on it' trick. We're also interested to find out if he's Moslem, hence the mention of Ramadan. |
Date: Thu, 31 Oct 2002 20:14:33 -0800 (PST) Hey Shaka, my porcine compadre, |
|
He seems to be goin' for it. |
From: "shaka momodu" <shakamomodu@caramail.com> Dear friend, |
|
So, to summarise: we're asking him to wait at the arrivals gate in Accra airport while an Alitalia (Italian airline) flight disembarks, holding a sign that says "RIDEREAME: SONO IMBROGLIONE". Hmmm. You know, our Italian is very rudimentary, but it's just occurred to us that if you put a couple of extra spaces in that sign, it could be very easily misinterpreted by the disembarking Italian-speakers: RIDERE A ME: LAUGH AT ME: Ooops! Whadda-mistake-a-ta-make-a! :-) |
Date: Sun, 3 Nov 2002 15:17:01 -0800 (PST) Hey Shaka, my rotund roisterer, |
|
Uh-oh. He's trying to avoid the meeting. Either he's getting the jitters at the idea of meeting a Mafiosi, or (more likely), it's just clicked that he isn't going to look anything like the photo he sent us. |
From: "shaka momodu" <shakamomodu@caramail.com> Dear robert, |
|
Hopefully this will force his hand. |
Date: Mon, 4 Nov 2002 13:49:05 -0800 (PST) Hey Shaka, my portly pal, |
|
Looking better now: |
From: "shaka momodu" <shakamomodu@caramail.com> Robert, |
|
Better and better: just four hours later, and he's obviously thinking things through and making plans. |
From: "shaka momodu" <shakamomodu@caramail.com> DEAR ROBERT, |
|
Curse it, we thought we had the dates right, but it turns out that there is no Alitalia flight into Accra on Nov. 10. Hopefully he doesn't have a problem with the date change. |
Date: Tue, 5 Nov 2002 16:39:33 -0800 (PST) Hey Shaka, my clever, corpulent compadre, |
|
Apparently not. :-) |
From: "shaka momodu" <shakamomodu@caramail.com> Dear robert, |
|
It's fairly unlikely that we will get a result with this, but we just had to give it a try. |
Date: Wed, 6 Nov 2002 13:43:01 -0800 (PST) Bonjourno! |
|
Poor sap, he's really sounding nervous that Bobby won't be there. Of course, he's absolutely right :-) We wonder whether he's been let down before? Tall, dark, skinny, handsome? Who the hell was in that photo he sent us then?? :-) |
From: "shaka momodu" <shakamomodu@caramail.com> Dear robert, |
|
OK, who's more stupid here? Him, for getting the day wrong, or us, for not noticing until just before we sent this message? It is just remotely possible that he is actually testing Bobby, to see if he is familiar with his own itinerary. But then, how likely is that? :-)
Lots of reassuring detail included here to help convince him Bobby really is coming.
A little extra cheese in the trap, just to be sure. |
Date: Thu, 7 Nov 2002 20:31:06 -0800 (PST) Hey Shaka, my compadre, |
|
Oh dear. Suddenly things have gone disastrously wrong. With the benfit of his email account password, which we had engineered out of him literally the day before, we were able to see that our previous message had not gotten to his mailbox before he wrote this, and so he obviously spat the dummy at not hearing from Bobby for two days. This is potentially a complete disaster, and all the fault of caramail. (Even with this outbound message, the full headers tell us that there was a 19 minute delay from caramail to yahoo.) |
From: "shaka momodu" <shakamomodu@caramail.com> IF YOU DO NOT CALL ME I WILL NOT TRAVEL. |
|
What follows was somewhat confusing. Basically, at appropriate intervals we sent him some urgent-sounding messages asking him to contact us. In this period, we also lost direct access to caramail - their web site simply stopped responding, not even providing a login screen. We were quite concerned that they had cut off international access, which of course would include Shaka's access, and that it was therefore all over. Eventually we found an anonymous proxy through which we were able to access caramail again. This showed us that he ignored all subsequent messages for a while, and then later read only the message (below) with the Subject "Shaka plaese reply". In this period we also rather stupidly opened one of our own messages while in his mailbox, therefore marking it as 'read'. With no 'mark unread' feature at caramail, we had to then delete it, and send a later message with the text of the earlier one included. If he is aware that caramail were having problems (curse them!) then the disappearance of this earlier message shouldn't phase him. |
|
|
We start with this, offering him an 'out' for talking to Bobby so rudely. We could of course have started getting heavy with him, Mafia-style, but eventually that would have to get quite nasty, and we don't really want to go there. We included the complete text of our goomba/alligator-skin briefcase email (if we recall correctly, it still hadn't arrived at caramail at this stage, so we wanted to make sure he got it.) Unfortunately, this was the message that we inadvertently read in his mailbox, so we had to delete it. The text of it was then included in the second message below. Remember, he never actually saw this one on its own. |
Date: Fri, 8 Nov 2002 05:27:58 -0800 (PST) Hey Shaka, what is going on? I woke up this mroning |
|
This is the message that, after a delay, he eventually read before the others (including the original delayed goomba/alligator-skin briefcase message.) |
Date: Fri, 8 Nov 2002 14:19:14 -0800 (PST) Hey Shaka, my compadre, |
|
Hoo boy. Because of our screw-up above, we now send him this, as a way of making sure he gets the 'excuses' message text. Hopefully he will look at the dates and times, put it all together, and blame caramail, but we think that's giving him too much credit :-) |
Date: Fri, 8 Nov 2002 22:36:34 -0800 (PST) Hey Shaka, my compadre, (Here we have the text of the message above in which I supply him with excuses for his angry message.) > |
|
OK. Still with us? Sorry about all that. Finally we hear back from him, proving that he does have access to caramail (even though we still don't). Disastrously, and probably due to his earlier suspicions, he has now managed to translate the sign. Nonetheless, persistent little bugger that he is, he still leaves the door ajar for a reconciliation... |
|
|
"It hurts" - ouch! The originating IP has suddenly changed to one we haven't seen before. Perhaps he really did have trouble with direct access to caramail? This address is apparently from a Telstra Australia range - odd. "... never do anything to hurt you ... Do not judge me ... I am very hurt." Oh boo hoo. |
From: "shaka momodu" <shakamomodu@caramail.com> Dear friend, |
|
Another copy of the above. Why? |
From: "shaka momodu" <shakamomodu@caramail.com> Dear friend, |
|
By now, we have gained access into a number of his other email accounts, and we are uncovering some very interesting information (including what is probably his real first name). We need time to scour through these and build up a picture of his activities, so we decide to stall him. (Incidentally, despite his claims above, he has launched another scam from a different account as recently as November 6.) |
|
|
Capital letters: "Look, moron, we're pretending that Bobby hasn't read your 'hurt' messages. OK? Get it?"
We try to steer him to understanding that caramail was having problems, with the implication that this would explain our not having got his 'hurt' messages. Probably too subtle, though.
We warn him that Bobby will be trying the bank address, and start feeding him the story about going straight to Sicily.
"Am I your pal? Or not? Now I'm the hurt one :-( Boo hoo." |
Date: Sun, 10 Nov 2002 12:39:27 -0800 (PST) Hey Shaka, my absent compadre, |
|
We did this mainly to stay in character - (we are pretending that) Bobby hasn't heard from Shaka for some time, so he has to be assuming by now that emails to Shaka will not get through, and time is running short to stop him going to the airport on Monday. At this point, the more confused we can make him, the better. Bobby's apparent non-reception of his 'hurt' messages, his apparent continuing concern that Shaka shouldn't go on a wild goose chase to the airport, and his minor deviations from the correct bank storyline here, should all contribute to this (assuming that Mr. Thicky actually notices any of these points -- hardly guaranteed.) |
Date: Sun, 10 Nov 2002 12:48:16 -0800 (PST) TO wohm it may concern, |
|
And now we wait. As of 11 Nov 05:07 GMT, the most recent message to Shaka still hadn't turned up in his mailbox. Our next check was at 11 Nov 07:23 GMT; byt that time the message had arrived, but he had not read it. |
|
|
In reply, just the same whinging rant again. |
From: "shaka momodu" <shakamomodu@caramail.com> Dear friend, |
|
We're somewhat intrigued by the fact that he's still willing to talk to Bobby at all, so we continue to hold the door open - but on our terms. Mainly, however, we're just stalling here to give us time to fully research his network of mail accounts. |
Date: Mon, 11 Nov 2002 13:41:14 -0800 (PST) Well Shaka, it's Monday afternon here, and FINALLY I |
|
Well, we don't think Bobby will be hearing from Shaka in a while, because today we noted that at some point since receiving the message above, Shaka set up a 'kill' filter in his account, which will take any incoming email from the address roberturich2002@yahoo.com and dump it straight in the trash :-) |
|
|
Some considerable time has now passed (it's almost two weeks since Bobby last heard from Shaka), and Chaos Project #1 is drawing to a close. In about 20 hours time from the sending of this message, we plan to take over the two websites listed, and soon after that this site will appear, hosted at the first of these two addresses. Unbelieveably, this message did actually turn up in his caramail Inbox just minutes after it was sent. Naturally, we had removed the anti-Bobby filter first :-) |
Date: Sun, 24 Nov 2002 04:28:56 -0800 (PST) Hello, Gadi. |
|
Having presumably read the above message, in which we explicity state that we know his account password, it still does not occur to our little friend that it might be a good idea to change it. Thus we can read the confirmation message from Yahoo! that arrives to remind him that he changed the password at this time on his account gadiadams22@yahoo.com. |
|
|
And then, a couple of hours later:
A happy moment here at The Chaos Project: |
From: "shaka momodu" <shakamomodu@caramail.com> FUCKEN FRAUDSTER STOP USING MY NAME TO DO BAD. |
|
And that, we suspect, is that for the relationship between poor orphaned Shaka and Bobby "Brown Eyes" Urich. A bit of a shame, really, as Bobby never got to send the picture of Shaka in the MGF with the numberplate "MGBADA". And caramail.com are roundly cursed for fouling up what was shaping up to be a legendary airport sting. Nonetheless, Bobby did his work: he kept Shaka talking while The Chaos Project sized up his operation and prepared for the final offensive. Plus, he provided a little innocent fun along the way. Ciao, Bobby, and thanks for all your help! Fuggedaboutit! |
|
