Is Gemma Brown really collecting chain e-mails for a university study?

from the December 2005 Newsletter
by Rob Zorn

A couple of customers have asked recently about an e-mail they've received from Gemma Brown who purportedly got their e-mail address from a chain letter or out of the CC field of an e-mail she came across. "Gemma" claims to be doing some serious research into chain e-mails and asks that if you have any more, that they be sent to her at the e-mail address she specifies.

On the surface this seems a little plausible, and people who have sent stuff to the address did not get mysteriously infected with a virus, or have their identity stolen. E-mails sent to her didn't bounce, so they must have gone somewhere.

But does Gemma exist, and is she really doing this research project? If it is a hoax, then what is the point of it all?

We can be fairly certain that it is a hoax. There is absolutely nothing on the web anywhere about such a research project, and the domain associated with her e-mail address (www.research-project.org) has had an "under construction" image on it for quite some time. Also, the domain was registered by someone using an e-mail address from Who-Remembers-Me.com, a site that has been the subject of a large number of spamming complaints.

There could be a couple of motivations behind such a hoax. People who start hoax virus rumours simply derive a thrill out of getting so many people to do something (e.g. forward the hoax mail to all their friends). For them, it satisfies some infantile need to fool lots and lots of people, and this could be something similar.

A second reason for the hoax (and it's the e-mail address of the domain registerer that suggests this most plainly) would be the harvesting of e-mail addresses for spamming purposes. Obviously they already have your e-mail address, but the CC fields of those chain e-mails that get churned tirelessly around the Internet are a rich source of real e-mail addresses for spammers. "Gemma" says she wants a million e-mails. If "she" got 5 unique e-mail addresses per e-mail "she'd" be doing pretty well.

Our advice, then, is not to forward all your chain e-mails on. In fact, if you're forwarding e-mails on to a large number of people, put their addresses in the BCC field. That way they can't be so easily harvested.

Oh, and Gemma, if you read this and I've done you a disservice, please drop me a line and let me know.