A Phishing Scam, a Hoax, or Something Creepier?

 

I’ve been hesitating to write this post. I don’t want to throw gasoline on a fire, and if all of this is some sort of weird or sick hoax, I don’t want people to know that it got to me.

But I’m angry, and creeped out, and I figure that if I write about it, maybe other people will have something to go on should the same thing happen to them.

It started with this email, which I received several days ago:

Hello,

This is probably the most bizarre email you will receive today – but stay with it!

A few months ago I was contacted by a man on a BDSM website who sent me via PM the picture attached. I have since found out of at least 3 other women who he has contacted. Asking each of us to put ourselves in a potentially dangerous position. Rest assured that none of us have. I have since been sent two further pictures from your blog which he is passing off as his own.

I wanted to inform you that this is being done – I am happy to go into further detail should you wish.

Kind Regards,
(Name Withheld By Geraldine)

Now, I get a lot of weird emails, and I usually delete this stuff immediately. I only clicked on this one because the title was “Photograph Theft”, and as a blogger, stuff from my site is lifted all the time. Sometimes I’ll pick a random (but nevertheless distinct) line from my blog and enter it in Google. Wowzers. The number of results that pop up are staggering.

So naturally, I wanted to know what was up with someone stealing my photos.

But when I opened it, I found myself staring blankly at the email for a long time. These are the thoughts that rushed through my head:

1. GAH! VIRUSES! VIRUSES EVERYWHERE.
2. Why did I open this again?
3. Wait, what’s BDSM again? Isn’t that a sort of computer cable that … nope. Nope, that’s not what it is.
4. I bet The Pioneer Woman never has to deal with crap like this.

I reread the email. It looked like a pretty classic phishing scheme. No reference to my site, reference to a BDSM site (which seemed a superfluous detail, used only to get me to worry), as well as an attachment (ready to unleash god-knows-what onto my computer). I was about to delete the email immediately (and report it to Google) but one thing stopped me.

Even if you don’t download an image in your email, Gmail will give you a preview of it. And so, at the bottom of the message, I could see the preview image.

It was of Rand. An innocuous photo that’s appeared on my blog and Flickr stream. That gave me pause. And freaked me out.

I copied some of the text of the email and pasted it into Google. No results. Ditto when I did a search for the email address. Whoever had sent the email was either totally sincere, or it was a phishing scam catered exactly to me.

I replied to the email as follows:

Name Withheld,

Wowzers. That’s crazy. I’m so, so sorry that you had to deal with that. Our culture isn’t very sex-positive towards women in the first place, so it sucks that on a site where you feel comfortable, there’s some jerk making creepy and dangerous requests. I seriously hope you reported him to the site administrators, or started a thread that outed him – something to make sure he knows that he can’t be doing stuff like that.

I suspect that he took the photos straight off the site, or possibly off of Flickr directly. In either case, there’s not really anything that I can do to stop him, sadly. Please feel free to report him to whoever is appropriate, and I’ll keep my fingers crossed it doesn’t happen again.

And then I immediately reported it to Google.

I figured that would be that. I told Rand what was going on. He was pretty convinced that it was phishing, but he was freaked out by the possibility that his image was being used, particularly in manner that targeted women.

I got another reply from the woman.

Hi Geraldine,

Not only have I written a blog about it, its hit the heights of “Kinky and Popular” with people contacting me from around the world about it! Unfortunately I’m not able to name him in the blog but enough people have contacted me privately to ask for his name for it to get around the scene!

When I tineyed the picture he sent me it came directly from the blog rather than from flickr, since looking at his profile online its come to my attention that all of his pictures are lifted from other sites. Yours being the only one I was able to get in touch with.

As I said in my first message, its a few pictures he’s sent. But its a shame there’s nothing you can do about it, but at least you are aware now.

Name Withheld

Now, here’s where stuff gets even weirder (if possible). Obviously, I didn’t download the images she attached, but I was able to locate the originals pretty quickly. And when I tineyed them, they led not to my site, but to Flickr. But she was insisting they came from the blog. Also, she was now using my name, but only after I replied to her (so there was still a chance that the first email she sent was a mass phishing email, that somehow pulled images from my computer and made them look like they were attached).

At this point, I dragged Rand into the whole mess. I wasn’t sure what to do, and he suggested I contact the woman once again and ask for a link to the forum, or some more information. He wasn’t entirely sure what to make of the situation.

Hi (Name Withheld) –

I talked to Rand, and he was obviously pretty perturbed about the whole thing (since it’s his image being used) and wanted to delve into things a bit further. Would you mind forwarding me a link to your blog, and to the forum at which you met this guy (and possibly his username, or something like that)? It would be very, very appreciated!

Within a few hours, another reply:

Hi Geraldine,

This is the link to my writing (link redacted). I’m not sure if non-members can see it though, so you may need to set up an account temporarily to see it. The caretakers of fetlife have actually removed his accounts (he had two) but I am more than happy to pass on the email addresses that I have for the guy. As I said, he’s been sending them via email. I have been sent one and another woman 3. They are all images of Rand.

I knew better than to just follow the link, so instead I did a Wikipedia search on the root domain. It led me to this entry (which is SFW). The site was apparently a social networking site for people with kinks and fetishes. Users of the site apparently agree to “not make criminal accusations against other members in a public forum”, which is, obviously, extremely problematic. Cases of violence, rape, and coercion go unreported.

I didn’t follow the link, but I entered it into a few more sites that test how safe a link is. I found that it redirected to a login page at the same root domain. I could not, in fact, see her post without creating an account, which I had no desire to do.

I wonder if that was part of the plan. Whoever had composed the email had figured there was no way I’d register for an account on a BDSM site, so it was a safe bet to include it, knowing I’d never follow it.

Or perhaps it was all legit.

I wasn’t sure. But I was getting caught up in all of it, and I’d spent way too much time preoccupied with the matter. Rand seemed rather undisturbed by the whole thing, except for one morning, when were talking and he finally said, “You know … this really creeps me out.”

I nodded. I’d been upset because they’d taken my beloved’s photo. I couldn’t even imagine how he felt.

 

“I’m also really bugged by the fact that, whether it’s a scam or not, someone has made us a target. And … I just didn’t think that we were that visible,” he said.

Hoax or no, all of this hit a deep nerve, one that comes up every now and then. We share a lot online. There’s plenty information about both of us that’s readily available, and we have no qualms about it. But stuff like this made me wonder – how much sharing was too much?

Rand pointed out that it didn’t really matter – even if there was only one picture of him online, this could have happened. He wanted to know if the woman I was conversing with had any more information to give us. I emailed her again.

Thanks so much. If you can also send me the email address(es) for this guy, that would be great. I know that Rand would appreciate it.

Thanks again for all your help on this!

She replied, of course. And promised to send more attachments.

Hi Geraldine,

I will forward you the email with the pictures attached – then you can see which pictures the guy has used. You’ll then have one of the email addresses. The wording in the email is not particularly nice, but then at least you can see what is being said. I am yet to decide whether to email the company he claims to work for, I will discuss that with my partner at the weekend and see what he says; it may be that he emails the company!

I’m sorry that you guys have got caught up in this, I just couldn’t sit back and not inform you about what was going on, and as I said I only found out when I tineyed the picture that I attached in my first email. I would appreciate it if you could let me know of anything you do so I am kept in the loop.

She emailed me again, this time forwarding the email of another woman who’d been victimized, and HER exchange with the guy who’d supposedly stolen Rand’s picture. More photos attached -two of Rand, and one of a terrible logo that the guy had created (again, I downloaded nothing, but simply saw the preview in Gmail). I began to wonder if that was part of the plan – she couldn’t get me to download the images of my husband, but perhaps she could get me to download the logo, hoping that I’d do so in order to tineye it. Here was the original supposed message from the guy who’d been using Rand’s photo:

Hi missy

well you have certainly managed to get me to expose myself more than I had planned to at this stage, so well done on that acheivement.

I attach for you another 2 photos of me in various places visited during 2013. I have more and can keep sending them but I hope you can see that it really is all me me me.

I work freelance as I said but I have always used the trading name ‘(redacted)’.

sounds silly maybe but I am always asked to make things look nicer or better, to redesign them etc so the name always worked for me.

I trade under my own name but have a lovely logo that I use which I have attached again for you. And yes I did design it myself although it was years ago!

so then missy….. when can we speak?

I had a wonderful though about you today (all of this was removed by Geraldine, because you don’t want to read it.)

anyway ball’s in your court.

 

I stared dubiously at the logo (a cluster of multi-colored tadpole-looking blobs swirling around a name) and the email address. I did a search for the latter, and found it led to a web design company in the UK with the same logo.

The company’s website didn’t tell me much – not a single employee name or photo was listed. The logo was so bad, I began wonder if it was all a big hoax.

I wasn’t sure where to go from there. Contact the company? Out them? I realized I couldn’t do that; I had no evidence that the guy had done anything – it was just a forwarded message that easily could have been faked. For all I knew, this was some sort of weird, elaborate scam to ruin a company’s name.

I did a few more searches, and found a guy who was supposedly the owner of the company in question. A few more searches, and it revealed a professional website that belonged to him, but all of the information on it was canned and regurgitated. There was even a 555 phone number.

I sighed. This was a waste of my time. I’d gone down a rabbit hole. There would be no resolving this.

I went back and deleted the last few emails,  reported them all to Google, and have decided to forget about this whole thing. I never downloaded anything, so Rand’s convinced my computer is okay, but I might take it into his office and have someone make sure there’s nothing creepy on it, just in case.

The only thing I can conclude is this: in either case, someone took Rand’s photo, and is trying to use it for their own purposes.

And, holy crap, does that piss me off.

Sign Up For My Super Cool Email Club

I'll send you fun stuff every now and then. (No spam. Promise.)

Submit

Leave this field empty if you're human: