I guess it's too much to hope for that there's a Poem Fairy.

December 22, 2011 2:17 AM

I got weird spam (?) consisting of an 8th-century Chinese poem. What's up with that?

Early this morning, I got an e-mail (which got past my spam filter) from snsbay.com, which seems to be some kind of Chinese auction site. Here are the full headers and text of the message:


From [e-mail] Thu Dec 22 02:58:04 2011
X-Apparently-To: [my address] via 217.146.188.112; Thu, 22 Dec 2011 03:54:07 +0000
Return-Path:
Received-SPF: none (domain of mail.snsbay.com does not designate permitted sender hosts)
Z2UgVG8gU3VwcGxpZXIKCiAKIAoKIAogCiAKIAoKTW9vbmxpZ2h0IG5pZ2h0
IApEdSBGdSAKClRoZXJlIHdpbGwgYmUgbW9vbiB0b25pZ2h0IApvdmVyIEZ1
emhvdS4gCkluIHRoZSB3b21lbnMgcm9vbXMgCnNoZSBpcyBnYXppbmcgYXQg
aXQgYWxvbmUuIApGcm9tIGFmYXIsIApJIHBpdHkgbXkgbGl0dGxlIGNoaWxk
cmVuOyAKVGhleSBkbyBub3Qga25vdyB5ZXQgCmFib3V0IENoYW5nYW4uATAB
AQEB
X-YMailISG: IcuIWxcWLDtcI7ZCoYlB7T4kNmGfEs_HBGPefn1MWkUp9W11
m94VCPJuatJaAWU.6smm56fTzKG2ZPXIfJsUPH7CnJir2osvPobYSYH9jb8W
dhLMh2_gWKiPcQMhJeuiUGhbKAKF0Ah_DBFAWsPsjEA68OZiURplzQFtwxtn
NXDD2QLpSBWVZntFGpUDwSsTQhuSLY5R4d_pBYpm0xHYUGPneFIQN23FjNNx
Q9lcwzGWjJC6cykoEx0SJp76Pppenic3ypm1GhVOgMOAVVPATCSG.DNhVkk.
sMMSPNT0F.g5ljBIp6P6u.Il0alIImi987BxAstWto91.N6xuDHjHy4eRprj
A.YubqeRGbx7oldXqm.mNCzp83QzRx5Ba1PFfRA-
X-Originating-IP: [71.139.220.123]
Authentication-Results: mta1016.bt.mail.ird.yahoo.com from=snsbay.com; domainkeys=neutral (no sig); from=snsbay.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO mail.snsbay.com) (71.139.220.123)
by mta1016.bt.mail.ird.yahoo.com with SMTP; Thu, 22 Dec 2011 03:54:07 +0000
Received: by mail.snsbay.com (Postfix, from userid 505)
id 2215B20C0888; Wed, 21 Dec 2011 18:58:04 -0800 (PST)
To: [my address]
Subject: Poem: Moonlight night
X-PHP-Originating-Script: 1001000001:send_html_email.php
From: [e-mail]
Reply-To: [e-mail]
Content-Type: multipart/alternative; boundary="PHP-alt-03d2c2e002258f3641503068cdeec8d6"
Message-Id: <2>
Date: Wed, 21 Dec 2011 18:58:04 -0800 (PST)
Content-Length: 3578


[SNSbay logo] S & S bay http://www.snsbay.com
Message To Supplier

月夜
杜甫

今夜鄜州月，闺中柢独看。
遥怜小儿女，未解忆长安。
香雾云衫湿，清辉玉璧寒。
何时倚虚幌，双照泪痕干。

Moonlight night
Du Fu

There will be moon tonight
over Fuzhou.
In the womens rooms
she is gazing at it alone.
From afar,
I pity my little children;
They do not know yet
about Changan.
In the sweet mists
her cloud-like hair is damp;
In the clear shining
her jade-white arms are cold.
When shall we two lean beside
the filmy curtain
With moonlight on us both
and the tear-stains dry?

[broken image]

Team Member: S&S bay
IP Address: 192.168.1.72
Country: United States

A few points:

1. That is a genuine poem by a genuine poet, though it looks like an amateur translation.
2. I ran the Chinese characters through Google Translate, and they do seem to be the actual poem, although Google had some hilarious interpretations of some of the characters.
3. As far as I can tell from the headers, the e-mail really did come from snsbay.com. But I'm no expert.
4. The link that says it goes to snsbay.com really does go there. There aren't any other links embedded in the message that I can see.
5. IANA says the IP address at the bottom belongs to "private address space."
6. A quick Google shows that this snsbay address seems to have been sending out Chinese poems via e-mail and Usenet for a while now, but I haven't found any explanation of why.

I've got plenty of spam e-mails before with random text or literary quotations, but they usually include a sales pitch for Viagra or links to dodgy sites as well. There really doesn't seem to be anything like that here. What did the spammer get out of sending this to me? Should I be doing a virus scan right now?

Any ideas are welcome!

posted by Perodicticus potto to computers & internet (7 answers total)

Probably Bayesian Poisoning.
posted by EndsOfInvention at 2:58 AM on December 22, 2011 [3 favorites]

Isn't the logo and URL in the message content sufficient to get you clicking and checking out who this strange company is who've merely sent you a poem?

That's my guess as to their strategy, anyway!
posted by springbound at 3:21 AM on December 22, 2011

I get spam here in China where the sales pitch (for dodgy tax receipts etc.) is placed in an image to avoid filters - maybe whatever they were about was in the broken image link?
posted by Abiezer at 3:24 AM on December 22, 2011

Yeah, bayesian poisoning was the first thing I thought of.
posted by Foci for Analysis at 5:12 AM on December 22, 2011

It's an attempt to slip past your spam filter.

The poem is probably the most famous poem in Chinese, everyone learns it in grade school (or in college Chinese class, like I did). Something like "The Raven" or "O Captain, My Captain." Or "This Is Just To Say."
posted by miyabo at 5:24 AM on December 22, 2011 [2 favorites]

I found this little bit from the title tag telling:

title>
Free product, service listings.
Free advertisements.
Free POP3, IMAP emails.
Email and web hostings with your own domains!
Facebook proxy
Proxy to facebook
Wendi Deng

Multiple Scleros
Katie Couric
Alanis Morissette
Mortgage Preappr
Fuel Efficiency
Men at Work
Mortgage Rates
Linkin Park
Martin Sheen
Smartphone


I'm with spam the spam fiter dodging theory. The whole site seems a little like the work of bottom feeders looking for a few quick hits.
posted by Gilbert at 6:59 AM on December 22, 2011

Thank you all for your replies - sorry for being away so long. I do appreciate it.
posted by Perodicticus potto at 2:44 AM on March 3, 2012