Spammer named 'Ashley J. Sands' who harvested everyone's email from djangopeople.net

[David Ross @ Wolfeon]

Disregard the email coming from the individual and I don't recommend
doing business with such a leech.

This guy wrote a program to harvest emails and mass spam using Google
Gmail, the access method of SMTP.

How I know the guy is a leech:
1) There's no User-Agent header
2) He negligently used the From: e-mail address in the To: field
instead of placing the recipient's e-mail.
3) Others in #django on IRC have confirmed receiving the email
4) The email is not personal. As a member of DjangoPeople, I list my
real name on the profile.
5) The site listed has WhoisGuard protecting the whois information
6) There is no address listed on the website
7) Listing a meager task of "upgrading a django installation" as
significant. (*chuckle*)

Why anyone would hire a programmer simply because of an email is
beyond me, but whoever does use sucha method deserves to be screwed.

I've been subcontracted from IRC, simply by helping other individuals.
Had I the need at any point to pass some work, I'd pass work to
individuals in the Django community who spend their free time helping
others. Time is money, those helping others are doing so at no cost.
So if anyone does happen to need help from key people in the
community, browse the mailing list or stick around on the IRC channel,
you'll find out who is who.

Simply put as a person who detests spam, "Ashley J. Sands, bugger off.
If you need a job, I hear McDonalds is hiring."

Below the email with headers which I received:
--------------------------------------------------------

Return-Path: <ashley....@gmail.com>
Received: from mx1.wolfeon.com ([unix socket])
by dingo.dancingroo.com (Cyrus v2.3.7-Invoca-RPM-2.3.7-7.el5_4.3)
with LMTPA;
Sat, 15 May 2010 03:51:56 -0800
X-Sieve: CMU Sieve 2.3
Received: from mail-gw0-f45.google.com (mail-gw0-f45.google.com
[74.125.83.45])
by mx1.wolfeon.com (Postfix) with ESMTP id D0CC16188001
for <d...@wolfeon.com>; Sat, 15 May 2010 03:51:56 -0800 (AKDT)
Received: by gwj17 with SMTP id 17so1521392gwj.32
for <d...@wolfeon.com>; Sat, 15 May 2010 04:49:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:received:mime-version:received:from:date
:message-id:subject:to:content-type;
bh=ivZN+3XRL9obp9FxwjRzrKJ5zJBVL2NIWGArPqJPseY=;
b=W0qOKwlErW/
qPf9NxpWgE0SPV8bZPZmFHRoYLDgXLmZB1XE5RWs0NVHarqnUFgLKWX
pmhGY0HyaolwnSQMN9eyHchO6z1OnOj02iylXMwB
+hNjGX70LivLS7oEYdKNSgNrpX7Q
L+Dg3WnpGa8AbtOFlpFqLaKQ2ZE/WQ+BNB1wk=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=mime-version:from:date:message-id:subject:to:content-type;

b=kYX7VY3L1qmOWFS7TtzMLdq3gqroIv2pave4g60m7ywXqd1/0VFEhZTaVQZ6McxU2t
F14fXdP9jFPEzMpQpDZ6xtkW
+lbn2Jli7S0wGhbTGDYYFFZ0x4LsnsurtPXatpPIzEjN
RnSiM35HfGRiEDgv97ptSSyZmUzTZSyTzxwMg=
Received: by 10.150.56.25 with SMTP id e25mr4007579yba.
188.1273924169169; Sat,
15 May 2010 04:49:29 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.150.219.14 with HTTP; Sat, 15 May 2010 04:49:09 -0700
(PDT)
From: Ashley Sands <ashley....@gmail.com>
Date: Sat, 15 May 2010 21:49:09 +1000
Message-ID: <AANLkTilE7CsBa_IxmLCs137SJMVID57RkX-
uaGj...@mail.gmail.com>
Subject: Fellow freelancer
To: Ashley Sands <ashley....@gmail.com>
Content-Type: multipart/alternative;
boundary=000e0cd611589300370486a09504

--000e0cd611589300370486a09504
Content-Type: text/plain; charset=ISO-8859-1

Hi,

I stumbled across your djangopeople.net profile and thought I would
send you
an email.

I am a freelance programmer like yourself but I have only been
freelancing
for several months. I was hoping that you could do me a favour by
checking
out my website, ajsands.com, and consider keeping me in mind if you
were
ever to have too much contract work. I must mention that I live in
Australia. As I am relatively new to Django, I charge a low
contractor's
rate of $40 USD/hr.

Thank you,
Ashley

--
Ashley Sands | Freelance Software Engineer
mob: +61412973530
ajsands.com

--000e0cd611589300370486a09504
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<meta charset=3D"utf-8"><span class=3D"Apple-style-span" style=3D"font-
fami=
ly: Verdana; font-size: 13px; "><div style=3D"margin-top: 0px; margin-
botto=
m: 0px; ">Hi,</div><br><div style=3D"margin-top: 0px; margin-bottom:
0px; "=
>I stumbled across your <a href=3D"http://djangopeople.net">djangopeople.ne=
t</a> profile and thought I would send you an email.</div>

<br><div style=3D"margin-top: 0px; margin-bottom: 0px; ">I am a
freelance p=
rogrammer like yourself but I have only been freelancing for several
months=
. =A0I was hoping that you could do me a favour by checking out my
website,=
<a href=3D"http://ajsands.com">ajsands.com</a>, and consider keeping
me in=
mind if you were ever to have too much contract work. I must mention
that =
I live in Australia. As I am relatively new to Django, I charge a low
contr=
actor&#39;s rate of $40 USD/hr.=A0</div>

<br><div style=3D"margin-top: 0px; margin-bottom: 0px; ">Thank you,</
div><d=
iv style=3D"margin-top: 0px; margin-bottom: 0px; ">Ashley</div></
span><br>-=
- <br>Ashley Sands | Freelance Software Engineer<br>mob:
+61412973530<br><a=
href=3D"http://ajsands.com">ajsands.com</a><br>



--000e0cd611589300370486a09504--

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To post to this group, send email to django...@googlegroups.com.
To unsubscribe from this group, send email to django-users...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/django-users?hl=en.

[AshleyS]

Hi David,

I guess now that you are convinced that I am a scammer there must not
be much I could say to convince you otherwise.

Previously I have contacted all of the Australian Django freelancers
and asked them if they had any work. I didn't scrape them, I manually
went through the 146 Australians of them and found 46 freelancers. 30%
of the freelancers responded to me and were all happy to check out my
website and consider subcontracting to me.

I then decided to contact all of the American Django people. But the
idea of clicking through 1.5K of them didn't sound appealing. So I
decided to scrap them. I didn't scrape the entire djangopeople.net
website, only the US Django people. This was my first and last
scraping experience.

Before I ran my python script to scrap the US people, I wondered
whether what I was doing was unethical. I was spamming many people but
I certainly wasn't a scammer. How can someone scam a Django freelancer
by asking for work? I'm not asking for money to free millions of
dollars locked away in overseas accounts. I was asking to to have the
opportunity to work. The only way someone would pay me is if I did a
good job for them, thus there is no way for me to scam them.

I convinced myself that it wasn't unethical because I did not have
evil intent and that it was in the best interest of some of the
recipients. Many Australian django users thanked me for contacting
them. This was surprising to me since I was thankful that they read my
email.

I sent my email via Gmail, so:
I dont understand what you mean by 1).
About 2), somebody sent me an email like this to me about a job and
thats where I learnt it.
4) is not true. ashley....@gmail.com is my email and my name is
Ashley James Sands.
6) I work from home as a freelancer so since no clients ever meet me
there, I don't list it.
7) I agree with that this is pathetic, hence why I was so desperate to
scrape and spam.

If I was a scammer, I would of dumped this email account and moved on.
I wouldn't be posting to this Google group forum trying to recover my
badly damaged reputation. The only way I can prove to you I am not a
scammer, is by asking you to ask yourself "What is his motive?". I am
just trying to get work, not scam money. A scammer never hangs around
to defend a false/stolen alias.

Also 7) is a great point to prove that I am real. If I were a scammer,
I wouldn't put something as pathetic as 7) on my website. I would of
listed many fake projects that did many great and wonderful things. So
since 7) is so pathetic and crap, it is proof that it is real.

I apologize to you David, everyone I spammed (~100 US Djangoers) and
the Django community for spamming those 100 email addresses. I have
learnt my lesson and I won't do it again.

This is actually quite embarrassing experience since I have made such
a stupid newbie mistake.

Is there any sort of community service I can do for the Django
community to attempt to make up for my stupid mistake? I don't want to
be forever labelled as an evil scammer and I am willing to give back
to the Django community as an attempt to recover my reputation.

So here's the chance for somebody in the Django community to get free
work, open source or not.

Once again I must say that I am sorry,
Ashley

On May 16, 6:11 am, "David Ross @ Wolfeon" <david.r...@wolfeon.com>
wrote:

> Return-Path: <ashley.j.sa...@gmail.com>

> From: Ashley Sands <ashley.j.sa...@gmail.com>

> Date: Sat, 15 May 2010 21:49:09 +1000
> Message-ID: <AANLkTilE7CsBa_IxmLCs137SJMVID57RkX-

> uaGjlG...@mail.gmail.com>
> Subject: Fellow freelancer
> To: Ashley Sands <ashley.j.sa...@gmail.com>

[James Bennett]

This entire discussion is inappropriate for this list. If either of
you wish to continue it, do so elsewhere.

--
"Bureaucrat Conrad, you are technically correct -- the best kind of correct."

[CLIFFORD ILKAY]

On 05/15/2010 11:18 PM, AshleyS wrote:
> Hi David,
>
> I guess now that you are convinced that I am a scammer there must
> not be much I could say to convince you otherwise.
>
> Previously I have contacted all of the Australian Django freelancers
> and asked them if they had any work. I didn't scrape them, I
> manually went through the 146 Australians of them and found 46
> freelancers. 30% of the freelancers responded to me and were all
> happy to check out my website and consider subcontracting to me.
>
> I then decided to contact all of the American Django people. But the
> idea of clicking through 1.5K of them didn't sound appealing. So I
> decided to scrap them. I didn't scrape the entire djangopeople.net
> website, only the US Django people. This was my first and last
> scraping experience.

I'm miffed that you didn't scrape and "spam" the Canadians, too. :)

> Before I ran my python script to scrap the US people,

"Scrape", not "scrap", by the way. :)

> I wondered
> whether what I was doing was unethical. I was spamming many people
> but I certainly wasn't a scammer.

I wouldn't consider this spamming. People put their contact information
on djangopeople.net presumably with the aim of being contacted. If
someone is so uptight that you contacting him to ask for work causes him
to go off the deep end and write a long-winded and nasty email to a
public mailing list effectively asking everyone to ostracize you, it
says more about him than it does about you. That person really should
not have his contact information on a public web site if he is that
sensitive about being contacted. Moreover, that person really needs to
read Dale Carnegie's classic "How to Win Friends and Influence People"
and apply the principles therein.

Having said that, Ashley, in marketing, what you did is known as "the
shotgun approach". It's a low-yield and not particularly effective way
of marketing.

> How can someone scam a Django
> freelancer by asking for work? I'm not asking for money to free
> millions of dollars locked away in overseas accounts. I was asking to
> to have the opportunity to work. The only way someone would pay me is
> if I did a good job for them, thus there is no way for me to scam
> them.
>
> I convinced myself that it wasn't unethical because I did not have
> evil intent and that it was in the best interest of some of the
> recipients. Many Australian django users thanked me for contacting
> them. This was surprising to me since I was thankful that they read
> my email.

While I wouldn't do it, I don't view what you did as unethical at all.
If you don't ask, you don't get.

> I sent my email via Gmail, so: I dont understand what you mean by
> 1). About 2), somebody sent me an email like this to me about a job
> and thats where I learnt it. 4) is not true. ashley....@gmail.com
> is my email and my name is Ashley James Sands. 6) I work from home as
> a freelancer so since no clients ever meet me there, I don't list
> it. 7) I agree with that this is pathetic, hence why I was so
> desperate to scrape and spam.

You didn't explain away #5, "The site listed has WhoisGuard protecting
the whois information", which is supposed to "prove" that you're a
spammer, so I'll do it for you. There are many legitimate domains
protected by WhoisGuard. Pointing to this as "proof" that the person
behind an email from such a domain "is a leech" is a bit much and
totally uncalled for.

> If I was a scammer, I would of dumped this email account and moved
> on. I wouldn't be posting to this Google group forum trying to
> recover my badly damaged reputation. The only way I can prove to you
> I am not a scammer, is by asking you to ask yourself "What is his
> motive?". I am just trying to get work, not scam money. A scammer
> never hangs around to defend a false/stolen alias.
>
> Also 7) is a great point to prove that I am real. If I were a
> scammer, I wouldn't put something as pathetic as 7) on my website. I
> would of listed many fake projects that did many great and wonderful
> things. So since 7) is so pathetic and crap, it is proof that it is
> real.

While upgrading a Django site from 0.96 to 1.1x isn't rocket science, it
isn't "pathetic" or "crap". Some experience is better than no experience.

> I apologize to you David, everyone I spammed (~100 US Djangoers) and
> the Django community for spamming those 100 email addresses. I have
> learnt my lesson and I won't do it again.
>
> This is actually quite embarrassing experience since I have made
> such a stupid newbie mistake.
>
> Is there any sort of community service I can do for the Django
> community to attempt to make up for my stupid mistake? I don't want
> to be forever labelled as an evil scammer and I am willing to give
> back to the Django community as an attempt to recover my reputation.
>
> So here's the chance for somebody in the Django community to get
> free work, open source or not.

If you're going to work for free, do it for an open source project or a
charity. Hang around on IRC and help people. Blog, answer questions on
this list, build sites, and have fun. The work will follow.

> Once again I must say that I am sorry, Ashley

Don't be so hard on yourself. It's not a big deal.

By the way, I'm <http://djangopeople.net/cilkay/>.
--
Regards,

Clifford Ilkay
Dinamis
1419-3266 Yonge St.
Toronto, ON
Canada M4N 3P6

<http://dinamis.com>
+1 416-410-3326

[AshleyS]

Thank you Clifford for the defense on my behalf.

Due to the unforgiving longevity of the Internet, it was my greatest
fear that this thread would gain a high search engine rank in regards
to my name. This could of permanently ruined my professional
reputation.

Off topic: I think Dale Carnegie was a very intelligent man.

Thanks for the advice. I will search out an open source project and
start contributing. I wish I could help with this list but I feel that
my lack of experience might render me useless in answering anybody's
questions.

Now at least I don't have grow a mustache, change my name and move to
Mexico :P

Thanks again,
Ashley

> > and thats where I learnt it. 4) is not true. ashley.j.sa...@gmail.com

[James Bennett]

Once again:

This discussion is inappropriate for this list; take it to personal email.

There will not be a third warning.

--
"Bureaucrat Conrad, you are technically correct -- the best kind of correct."