The barley is their goal
« previous post | next post »
You know what I think is happening? This is just too insane not to be true. I believe Hong Kong script kiddies wanting to try Nigerian-style thieving of bank account details are actually using Google Translate to translate their phishing messages from Chinese into English. Below the fold I quote in full (obscuring my address with x's to outwit the spam robots) a wildly, asyntactically unintelligible phishing spam which I received today. It's unintendedly hilarious — you could try reading it aloud at parties. And it's so garbled and implausible that I can't believe even poor naive Aunt Mildred will be suckered. Interestingly, it shows clear signs of being the output of very bad corpus-based translation, unsupervised and unchecked. My suspicion of Chinese provenance was based not just on the .hk (Hong Kong) address, but also on the fact that the spammer thinks an English-speaking PhD named Dr. Roller Key would refer to himself as Dr. Roller — that is, the Chinese syntax for personal names is being assumed.
Return-Path:
Received: from renko.ucs.ed.ac.uk (renko.ucs.ed.ac.uk [129.215.13.3])
by pisa.ling.ed.ac.uk (8.13.1/8.13.1) with ESMTP id p67JqTU8018102
for
Received: from server01.DeKalb2.local (oh-65-41-58-136.sta.embarqhsd.net
[65.41.58.136]) by renko.ucs.ed.ac.uk (8.13.8/8.13.4) with
ESMTP id p67JqN26017598 for
Received: from User ([82.128.68.29]) by server01.DeKalb2.local with Microsoft
SMTPSVC(6.0.3790.4675); Thu, 7 Jul 2011 15:52:15 -0400
Reply-To:
From: "DR.ROLLER KEY"
Subject: I sent it to you.Reply very urgent
Date: Thu, 7 Jul 2011 20:52:19 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Bcc:
Message-ID:
X-OriginalArrivalTime: 07 Jul 2011 19:52:21.0639 (UTC)
FILETIME=[6297C970:01CC3CDF]
X-Spam-Score: 9
X-Spam-Level: *********
X-Spam-Status: hits=9.211 tests=FORGED_MUA_OUTLOOK,MAILTO_TO_SPAM_ADDR,NIGERIAN_BODY1,
UNCLAIMED_MONEY,MDF_DYNAMIC_CLIENT version=2.64+local
X-Edinburgh-Scanned: at renko.ucs.ed.ac.uk
with MIMEDefang 2.60, Sophie, Sophos Anti-Virus, Clam AntiVirus
X-Scanned-By: MIMEDefang 2.60 on 129.215.13.3
Status: R
From: Dr.Roller Key
Egg Bank Plc, London.
Hello dear!
How are you and your family? I hope that the letter meets you in
good spirits. My name is Dr.Roller Key Operations / Regional Manager,
Branch Manager, Egg Banking plc, London. In the top secret / secret
collaboration decided to look solution to the mutual benefit of
both the activity described here.
During the annual bank audit abandoned, / unclaimed money, the sum
of 21,500,000 pounds sterling (21 million discovered five One of
those overseas customers (the late David McDowell Brown to the
account of one hundred thousand pounds sterling)) unfortunately
lost one of their lives with the entire crew in Arlington, Virginia,
February 1, 2003 to the U.S. south of the U.S. space shuttle Columbia.
After passing some of his writings I have in our bank account to
the beneficiaries of a special relative or I thought. I hope and
conscious of the value sum of 21.5 million pounds sterling, so you
kin / beneficiary to ask your permission to offer next to the
deceased each, for you are my percentage to be allocated 50% and
40%, 10% of to you for any expenses incurred in the processing.
I am your sincere cooperation, trust and confidentiality so that
the maximum need to successfully complete this transaction. I promise
and assure you processing of the home and here in London, a legal
arrangement that will protect you against the law must be made under
Funding your account is transferred to the bank. After approval of
this proposal and look, send me the following: More security for
e-mail address immediately:
1 Your full name:
2 Full contact details:
3 Your direct phone number:
4 E-mail:
5 Your Job:
Me to reflect in our database, giving the bank the bank the ability
to record information If the relative / next to the name of the
system BENEFICIARY account, and then establish communication with
the bank for additional you transfer money.
Note: The banking business within days, the barley is their goal.
With expectations for emergency responses.
Sincerely,
Dr. Roller.
Answer: rollerkey249@yahoo.com.hk
This has all the strange poetry I wrote about in Memory of qualities: armed structure and crystals (2005), plus all the hopeless incompetence that has prevented countless other email scam letters from being convincing (see "Forensic syntax for spam detection", "Inexpert and expert phishing spam", "Learn your grammar, Becky", and "Moron phishing", and Arnold Zwicky's "Phishy mail").
Fully automatic translation of phishing spam! Perhaps it is true that we are fated to have the machines rule us. However, not for a while, if the talent level of current machines is any guide.
After I posted the first version of this, Nick Lamb looked up the actual origin of the quoted email, and found out that it comes from 82.128.68.29, an address in a block allocated to Africa's registry, AfriNIC, which delegated it to a company in Lagos, Nigeria. So that makes it look like we have just another standard Nigerian scam from actual Nigeria. And yet there is the name order evidence of Chinese authorship, and clear signs of automatic translation so bad that only a Chinese source could fail to spot that it is as close to Martian as to English. I refuse to believe that a Nigerian is responsible for the syntax you saw above — English is in widespread use in Nigeria. Perhaps there are now monolingual Chinese scammers in Hong Kong using Nigerian addresses, or using a botnet that includes machines in Nigeria. I don't know.
What I do know is that Victor Mair stopped by my desk to explain about the barley that is their goal. As I first thought, the mistranslation does indeed suggest a Chinese origin. The relevant form for barley (not the commonest one) is móu 牟, which is not just homophonous with móu 麰 ("barley"), but in very ancient sources (e.g., the Poetry Classic, said to date to around 600 BC), can actually mean "barley". Generally, though, móu 牟 is used in expressions like "móuqǔ bàolì" 牟取 暴利 （"make; seek; reap high or exorbitant profits; profiteer"), or just simply móulì 牟利 ("make / seek a profit"). Where móu 牟 means "seek" or "try to get", it is widely seen as being roughly interchangeable with the very common word móu 謀 ("work toward; aim for; scheme; seek").
So the linguistic bottom line is, in Victor's opinion, that these are indeed Hong Kong phishermen, and they want to say that bankers are in a hurry to make outrageous profits, and if you want to get a cut, you'd better act promptly. The most frequent use of móu 牟 in modern contexts has to do with the earning of profit, but it looks like the Hong Kong script kiddies got out the dictionary and wrongly picked the earlier meaning, "barley". It also looks like you need a highly experienced university professor of Chinese just to fully understand your spam these days.
[Comments are closed. The last thing I want to do is phish for comments.]