How to take down a translation industry spammer

I get lots of emails of a clearly spammy nature, mainly to an email address used to outsource work as a small agency. They all seem to follow the same format with similar subject lines, layout and (mis)appropriated CVs. The email header information reveals nothing of use, as they use Hotmail/Gmail servers to send from. So to locate their whereabouts we need to turn the scam around a little.

Part 1 - Day 1

I set up a post on my agency site titled ‘English to Indonesian translation project’, password protected it, and published it to the site. Then I replied to the spammer saying:

Hi Vera,

Many thanks for your message. We could perhaps work together on a project we have received today. Would you like to give me your contact number to discuss?

Also would be glad to know where you got our contact details, for marketing purposes.

Best, Luke

Which was replied to positively, now from the email ‘translatorguide1@gmail.com’: Now I sent over the link for them to click, as follows:

Best regards, Luke

Using the server logs, I saw that the page was promptly visited by an IP address in Gaza, Palestine, staying on the page for some 5 minutes. That IP address is: 176...*, which belongs to Mada.ps, an ISP based in the area [1]. I emailed the ISP the details of the spam, mildly suggesting an escalation to their IP range providers, RIPE, if no action was taken by them. I doubt anything will be done on that front. The spammer isn’t using their mail servers, so it wouldn’t be a priority issue by any stretch of the imagination. Gmail and Hotmail support might appreciate the tip off, so I’ll perhaps follow up with that.

So now we have the IP address, location and ISP, what can we do? We need more information - if anyone can get an ‘Author name’ from the properties of any files sent over, that would be useful. The spammer has already modified that field in the CVs sent out to be that of the fake persona, but asking them for extra files (sample translations, certificates etc.) might yield something.

Another great way to combat this, short of everyone changing email addresses, would be for everyone to reply with a scam of their own - if everyone showed interest in the spammer’s services just a few times they would be inundated with thousands of messages and know that the jig was up. At least with the email list they currently use. Even if only 50 people did this it would show an awareness among their victims that the attempted scam is ridiculous.

After that last email, they went quiet, so I prompted them by pretending to need to place the job today. They replied with their ‘very best rate’ that I’d asked for (as a spam/scam/peanuts reference, of course) of 0.07 EUR. In reply to this I asked for a certificate or work sample. They went quiet again. Time to leave it for today.

Apparently a lot of translation scams seem to originate from Gaza, with fake agencies and freelancers from the region trying to oursource and take on work constantly. I have every sympathy for those living through life’s more difficult situations, but absolutely none for dishonesty and trickery. Hopefully this information might be of use to anyone else investigating further.

Part 2 - Day 2 - Success?

Day 2 brings with it an update to the story. The ISP took action against the user in question after being provided with a list of times of the emails being sent. I sent a dozen delivery times for emails that were received over the last few days, and when following up to see if that was of any use this was their reply:

Dear Luke

Hope my emails finds you as well

Yes your information was helpful and Case are followed and all required actions has been taken

Have a good day .

Lo and behold - I have received no spam today. At least not from our friends in Gaza. Now, they may simply have taken me off their spam list, but that might not be the whole reason; I received an email from them this morning with regards to the ‘job’.

You see, alongside the ISP action, I continued to lure the time-thief with a little time-wasting of my own. I woke up to emails sent in the middle of the night including samples of work and an email address for a reference. The reference email address shows up on plenty of spam/scam lists, so either the spammer underestimates their victims, or I overestimate their level of sophistication.

Following their offer to work on the project at 0.07 EUR, then, I sent:

Hi Vera,That’s great. Would you be able to send over a sample of a previous translation, or a reference you’ve received? That’s just to check before we assign - nothing too technical, just something in a Word doc etc.

Best regards, Luke

PS - A university certificate, perhaps, if you had one prepared, would work.

Of course, this is in line with all of the worst practices of the kind of translation agencies the spammer must be used to working with. It would be rude to not meet their expectations. This sent at 4am, followed a few hours later with:

Hi Luke, I managed to find some samples.

Please find the attached samples.

Regards,

Vera Kahar

With two documents attached, in English, with nothing to do with real estate or Indonesia. They contained dubious grammar, punctuation etc. as to be expected. Tut-tut. To this I replied:

Hi Vera,Thanks for getting back to us. Please could you try to translate the following as a sample, putting it in a Word file with the filename “Taking Down the Scammers in Indonesia” - that would be much appreciated.

—— 196 words —— Indonesia’s residential property price index (14 major cities) rose by 7.4% during the year to end-Q1 2013, the highest year-on-year price increase since Bank Indonesia began publishing data in Q1 2008. However adjusted for inflation property prices increased by just 2.04%.

Yet demand is rising strongly.  In the fourth quarter of 2012, residential property sales in Indonesia soared by 26.7% from the previous quarter. Small houses saw the highest sales growth, about 41% q-o-q in Q4 2012. In December 2012, the total outstanding housing loans in Indonesia rose a stunning 21.74% y-o-y, to reach IDR222.35 trillion (US$22.79 billion).

The reason for strong property demand?   Four years of strong economic growth. Indonesia’s economy grew by 6.2% in 2012, after real GDP growth of 6.5% in 2011, 6.2% in 2010 and 4.6% in 2009.  And Indonesia’s strong economic growth is expected to continue - real GDP growth of about 6.2% to 6.6% is projected in 2013.

Makassar was estimated to have seen the highest annual increase in property prices in Q1 2013, at about 15.6%. About 8 % of Indonesia’s total population lives in this historic port city. Makassar was followed by Palembang area (10.57%) and Denpasar (9.97%).

—— end of sample ——

Many thanks, Luke

Three hours later I received back the following ‘translation’ (with the correct filename!):

Sepanjang tahun hingga akhir Q1 2013, indeks harga properti residensial Indonesia (14 kota besar) meningkat 7.4%; ini adalah peningkatan selisih harga tertinggi sejak Bank Indonesia mulai mempublikasikan data pada Q1 2008. Namun, seberapa pun besarnya usaha untuk menyesuaikan dengan inflasi, harga properti hanya meningkat 2.04%.

Namun permintaan terus meningkat tajam. Jika dibandingkan dengan kuartal sebelumnya, penjualan properti residensial di Indonesia melejit hingga 26.7% di kuartal keempat 2012. Pada Q4 2012, peningkatan penjualan rumah berluasan kecil meningkat paling tinggi, sekitar 41% dari kuartal sebelumnya. Yang mengejutkan, pada Desember 2012 total KPR yang belum dilunasi di Indonesia meningkat 21.74% dari tahun sebelumnya hingga mencapai Rp 222,35 triliun (US$22.79 juta)

Apa alasan di balik tingginya permintaan atas properti ini? Tingginya pertumbuhan ekonomi Indonesia selama empat tahun. Setelah pertumbuhan PDB yang nyata sebesar 4.6% di tahun 2009, 6.2% di tahun 2010, dan 6.5% di tahun 2011, perekonomian Indonesia meningkat 6.2% pda tahun 2012. Tingginya pertumbuhan ekonomi Indonesia ini diperkirakan akan terus berlanjut – untuk tahun 2013, pertumbuhan GDP nyata diproyeksikan sekitar 6.2% hingga 6.6%.

Harga properti di Makassar diperkirakan akan mengalami peningkatan tahunan tertinggi pada Q1 2013, sekitar 15,6%. Sekitar 8% dari total populasi Indonesia tinggal di kota pelabuhan yang bersejarah ini. Tingginya peningkatan harga properti daerah ini diikuti oleh daerah Palembang (10.57%) dan Denpasar (9.97%).

Neither Google’s nor Bing’s machine translation engines produced an exact copy of this, despite similarities, but I would expect some MT engine out there has produced this. I can’t imagine an Indonesian native speaker actually worked on this, but unfortunately I am not qualified to tell [2]. One thing I do know is the the ‘Total editing time’ field came with 0 (zero) minutes in the file properties. The ‘Author name’ in the properties was ‘TOSHIBA’, which is not an entirely useful data point on its own.

I didn’t get back to them. As mentioned above, I heard back from the ISP in the meantime that action had been taken, and no more spam emails have arrived today. At all. I have asked the ISP for more information regarding the action taken and on the scale of the operation in question, but nothing as of yet is forthcoming.

It seems, although it is still very early, that the operation Translation Spammer Takedown was a success. I suppose I may yet be subject to some kind of cyber-retaliation so I only hope the story was worth sharing publicly.

Updates, if any, will follow.

---

[1] IP address censored in case the ISP has modified it. I will continue to attempt to string along the scammer, to check this sort of thing. Speaking from experience, a targeted IP address can be extremely problematic for ISPs.

[2] My sincere apologies to any Indonesian translators inconvenienced in this operation. I do hope that it turns out to be a machine translation.

Thanks for reading. I do translation from French and Swedish to English, so if that's useful to you, feel free to connect and message me on LinkedIn or Twitter.

Published by Luke 25 Feb, 2014 and tagged translation using 1812 words.

Next: What do you do with a spammer's personal details?
Previous: How to run multiple Wordpress sites on a single low-end VPS with Nginx