The Mugu Man

My mother sent me an email a few days ago concerning her website:

“There’s a guy who constantly leaves silly messages in my guestbook (calls himself Mugu). This has been going on for a couple of years now. I just delete them of course, but do we have any way of figuring out who he is and blocking him? He is really starting to annoy me.”

Being the loyal filial son that I am, I immediately (well, ok, a few days later) set to work finding out who the mysterious mugu man was. All I had to go on was the fact that he leaves messages like this on my mother’s page:

Name: MUGU
Addressfrom: mugu@mugu.com
Subject: seee
Message: Mugu no fit finishMugu no fit finishMugu no fit finishMugu no fit finishMugu no fit finishMugu no fit finishMugu no fit finishMugu no fit finishMugu no fit finishMugu no fit finishMugu no fit finishMugu no fit

This strange and obviously not quite sane creature would not hide long from me. I would find The Mugu Man and discover why he haunted my mother’s online guest-book. Being the highly trained researcher that I am, my first course of action was, of course, to do what everyone else does these days to find absolutely anything in the online universe: I googled the Mugu man…

A search soon revealed that my mother was not alone. The Mugu Man has been very busy. He has been posting bizarre and short messages all over the internet, at thousands of guestbooks from Irkutsk to China to the MacFie Clan Society of America.

Some of these sites and their regular denizens were as curious as my mother as to who this strange Mugu man could be. After a little more clicking through google results I found a number of pages with postings or articles claiming to have solved the Mugu mystery. Here are the best explanations I have seen yet (if you find better articles on this, send them my way). The articles usually argue that The Mugu Man, or the “Mugu Guymen” are not one person (who would be awfully busy to post on around 6,000 online guest-books) but are underlings of the notorious 419 “Nigerian” Scammers.

I’m sure most of us have gotten more than one offer promising us millions of dollars in exchange for simply helping some helpless but filthy rich African (or more recently middle-eastern or eastern-european) to transfer money safely out of the country. I have a modest collection of them myself which I actually keep for fun. The scams lure the incredibly gullible to Nigeria or wherever and rob them blind. Sometimes they bypass the “luring” and simply do the “robbing” directly. Hatred for them has spawned a whole new hobby called “Mugu Baiting” which you can read more about various places online.

Apparently, the Mugu Guymen hang out in the internet cafes of their home country visiting thousands of guest-books and copy all of the email addresses they can find there. These email addresses become the next batch of recipients for the latest variation of the 419 scam. When they finish copying all the addresses from a site, they will post a silly message (like the one above), sometimes with a unique signature, to let other Mugu Men from their own operation know that they have already visited a particular guest-book and copied all the email addresses down up to the point of the Mugu Man’s own posting. According to some of the web sites, the word Mugu itself means “fool” or “gullible person” in Nigerian.

This is a far less sophisticated method of harvesting email addresses (but more effective at overcoming the safeguards we put into hiding the email addresses on our sites) than the spam bots who surf across millions of pages in search of online email addresses for their Spam Masters.

Basically, there is little to be done. If your email address is online and viewable on a web page (even if it is “invisible” in the code to spam bots by using complicated JavaScript to assemble the address for the browser, a technique I use on many of my sites), the Mugu man can find the address and add it to their database. I recommend to everyone that if you post an email address online, don’t use your primary email address. Keep a “spamable” address for online submissions of all kinds.

The spam issue is way out of control these days. I believe that ultimately a system of “trust” email will have to develop. One idea, which I’m sure someone else must have thought of and developed into an organized idea is to have some independent body which monitors a “ranking” or “trust level” for particular email addresses. With each email a person sends from the address which has not been reported as spam and/or for which a reply was successfully received, the ranking could rise. Thus, email programs could, for example, only allow email with a certain “minimum” ranking to reach the inbox and lower ranking email could be more heavily scrutinized or put in a separate box or have a confirmation email sent or whatever.

The only problem I foresee to such a system would be that I can see how Spammers could easily automate a system which beefs up the “trust” factor of particular email addresses by sending email amongst themselves (perhaps with one address being kept “clean” with a high ranking) before sending out their spam into the world. I am confident however, that minds smarter than I could come up with ways to counter this.