I got this email in German…
Schönen guten Tag
Ich habe auf meinem Navi aus meinem Auto einen Riesentext wo unter anderem Ihre Mailadresse zu sehen ist?
Können Sie mich schlau machen was es damit auf sich hat ?
… which translated into English says:
I have a huge text on my sat nav in my car where, among other things, your email address can be seen?
Can you tell me what this is all about?
I replied (in English) to the question, explained how I’m the main author of curl and how his navigation system is probably using this. I then asked what product or car he saw my email in and if he could send me a picture of my email being there.
He responded quickly and his very brief answer only says it is a Toyota Verso from 2015. So I put an image of such a car on the top of this post.
When the spam bot didn’t consider other reasons for your email to appear on Instagram…
See also: Instagram and Spotify hacking ring.
“Josh” sent me an email. Pardon the language here but I decided to show the mail body unaltered:
From: Josh Yanez <a gmail address>
Date: Wed, 6 Jan 2016 22:27:13 -0800
Subject: Hey fucker
I got all your fucking info either you turn yourself in or ill show it to the police. You think I'm playing try me I got all your stupid little coding too.
Sent from my iPhone
This generates so many questions
- I’ve had threats mailed to be before (even done over phone) so this is far from the first time. The few times I’ve bothered to actually try to understand what these people are hallucinating about, it usually turns out that they’ve discovered that someone has hacked them or targeted them in some sort of attack and curl was used and I am the main author so I’m the bad guy.
- He has all my “info” and my “stupid little coding too” ? What “coding” could that be? What is all my info?
- Is this just a spam somehow that wants me to reply? It is directed to me only and I’ve not heard of anyone else who got a mail similar to this.
- The lovely “Sent from my iPhone” signature is sort of hilarious too after such an offensive message.
Very aware this could just as well suck me into a deep and dark hole of sadness, I was just too curious to resist so I responded. Unfortunately I didn’t get anything further back so the story thus ends here, a bit abrupt. 🙁
Just in case you missed my youtube/G+ posting from yesterday about my new trip to work:
Time to submit some more strange emails I’ve received recently. Here’s one I suspect may be someone who spots that curl is being abused against some host. I really wouldn’t even know how to begin to answer this…
Someone is using your code to continually hack small businesses I work
with. How on earth do I stop them?!
(This is an authentic email we received at Haxx the other day. Names, emails and URLs are replaced in this excerpt to save the innocent)
Date: Thu, 29 Nov 2012 14:59:25
hello, can you tell me how to hack into web site:
so it is showing:
when you click on a link in google results?
for example if you click on a google result:
[URL to a google.rs search for something on the FIRST URL site]
the point is i would like to protect my web site form that kind of attack so please let me know how to do that
how did i found you? there is your address at [FIRST URL]/coockies.txt so i think you did it, but was polite enough to leave address.. please help me.
Of course I was curious enough to check the “coockies.txt” file, and the beginning of that file looked like this:
# Netscape HTTP Cookie File
# This file was generated by libcurl! Edit at your own risk.
[FIRST URL] FALSE / FALSE 0 PHPSESSID dfn1a5ll0hs8odpfh3p2qtlcj3
This tells us a few trivial things, all of which might not be obvious to the untrained eye:
- The file was generated by libcurl that was 7.16.0 or later, but no later than 7.18.3 as we only used the URL in that file between those releases.
- The spelling of that cookie file is so hilarious we can guess it wasn’t a native English speaker who named it. The subject of the email is similarly bad so perhaps it was a fellow countryman of Serbia? (the TLD of the google URL was .rs after all)
- The person doing this didn’t even try to clean up the remaining junk file(s) afterwards
- The guy sending me the email is completely in the blue of what has happened or even who he’s contacting or my relation to this all.
- The world can be a harsh and cruel place and it isn’t easy to know your way around all of it…
Today I learned that Need for speed World (I first had to google what “NFS-world”Â actuallyÂ means) uses curl when I received this email:
I can notÂ go intoÂ the gameÂ for 4 monthsÂ my nicknameÂ “[removed]”.Â itÂ writesÂ the error “Login failed,Â please try again.”Â PleaseÂ solveÂ this problem. SupportÂ GroupÂ does not help.
But no, I don’t know why this guy emailed me…
I then went on to look for other Electronic Arts games using libcurl, and I fell over these forum posts that clearly indicate Game Face uses it, but I found no credits or other information page online.
Can you find any other?
How to figure out if a program uses curl? I get mails from users of it since the curl license is included somewhere and it includes my email address and very often that is the only address available…
To: Daniel Stenberg <daniel@haxx...>
Subject:Â Rosetta Stone Question
I am trying to install Rosetta Stone on my Mac but I am having
trouble. The ReadMe says to contact the author, and this email
was in the license info. Am I to understand that you are
I don’t know exactly what Rosetta Stone is, but I guess it is the language learning software at www.rosettastone.com
In my mini-series of strange mails I receive, here’s another one:
Subject: Product Request
I am interested in purchasing some of your products, I will like to know
if youcan ship directly to SPAIN , I also want you to know my mode of
payment for this order is via Credit Card. Get back to me if you can ship
to that destination and also if you accept the payment type I indicated.
Kindly return this email with your price list of your products..
I assume I’ll never figure out what products he speaks of, or how on earth he ended up sending me this… I’ll admit I was tempted to make up some “interesting” products to offer.
Update: I was informed that this is probably “just” another online fraud attempt. How boring.