Buddha Stones and the Wishing Machine
Mark Honeychurch (April 11, 2023)
Despite my regular attempts to unsubscribe from some of the more egregious nonsense I receive in my email, spam still gets through - at this point it seems there's a mailing list that I signed up to that is able to subscribe me to new lists quicker than I can unsubscribe from existing ones. And, to be honest, I don't mind that much. My spam filter is able to deal with most of the fluff, and the stuff that does get through is often great fodder for this newsletter. To that end, I recently received an email titled “The BUDDHA STONE Money Magnet Kit!” which intrigued me:
There wasn't much detail in the email itself, except for this intriguing piece of text:
Easy to use as 1, 2, 3
We do not know who makes these stones. It is a true mystery.
You can use the stone for any desire of any kind.
Hold the stone tightly in your hand, then decide what you want to accomplish.
It comes with simple instructions for fast, easy use.
For EXTRA power in your experiments, you will also receive the Portal Plate!
Before speaking a wish out loud, you can first "charge" your Buddha Stone by placing it on the mirrored "Portal Plate" for approx. 5 minutes.
And TODAY, it comes with two FREE BONUSES!
Okay, prepare yourself for what turns out to be a little bit of a wander down a side alley that finishes at a dead end. I really wanted to click on the link, but here's where I needed to be a little tech savvy. The link attached to the words “Order Here!” didn't go directly to an obvious site like “buddhastone.com”. It looked like this:
The URL had a short domain name (r20.rs6.net) that appeared likely to be part of a group of similar domains. Both r20 (the subdomain) and rs6 (the domain name) look like incremented names, although once you own a domain you can create practically unlimited subdomains, so I'm guessing only the r20 is one of a set. This suggests that the URL is probably used a lot for spam, and that when the domain they're using gets flagged by enough spam filters, they can simply increment the subdomain (e.g. to r21.rs6.net) and start all over again.
This kind of service will allow its users to do a couple of things using the long “query string” we can see at the end of the URL, by which I mean everything after the question mark in the URL (starting ?f=002uo2…).
Firstly, when that URL is visited, it will redirect the visitor to the real URL, and this link in the middle will allow spammers to keep using the same domain name for their nonsense product without it getting flagged by the spam filters - the filters will never see their real domain name, just these ever changing random domain names.
Secondly, that long string will likely be unique to my email, and will allow the spammers to track that it was me that clicked on it - and that would most likely result in me being added to more mailing lists, as they'll know that I'm the kind of person who's worth spamming as I'm clueless enough to click on their links.
If we break down the URL by splitting it where there's a question mark (?) or ampersand (&), we see these three variables:
_f = 001uO24ZMH15MrUM7jdDN0oVcsZKT16l_gT229xOMyaq2PdAS7xMRIgbtPD6bL9sYe83_F2Ex6BcgNpJEe0y_Fo-X9-byO31OaAVuiqAV6mkkIx6mpqY8MtZugHUPC9JpAsZ6m12ePL87ffnk8oa9UP5Wx7pCqtGylpoeK1jAgkJdZbwgAVta5JU_otu7WBWnrP
c = li6sWA82mx8MHbV-iCLr4nAZNf3pKEJDapBCbcem9D_qhhaM5yZAsA==
ch = yfN7JVGCiRrQV6V5vgf3XuTSozEiD3UjZM8OPNQpaVtIq5KfLehpRw==_
f, c and ch are the names of the variables being given to the server in the URL, and I'm pretty sure the strings, with a couple of them ending in a telltale “==”, are base64 encoded text.
When text is encoded with base64, it's converted from ASCII or similar, which has 256 possible characters, to a subset of ASCII that's safe to use in URLs (because it doesn't contain weird, illegal URL characters like newline, backspace, etc). For base64 that subset is A-Z, a-z, 0-9, + and /. Adding up the number of characters in each of those ranges, 26 + 26 + 10 + 1 + 1 = 64. I recognised that these strings are likely base64 because, when a base64 string needs to be padded at the end (because the translated characters don't line up properly), base64 uses one or two equals signs (=), as needed, for padding.
So, doing some sleuthing, we can search online for a base64 decoder, and when decoded we end up with this:
f = Mn;n0}y27C7JrJO^N3&@KLDlla7]Ǡ\I2Z>ߛ9*WzY</I
mvxC[
FZhxc umkTn`V
c = .X6~"p5(BCjBmǦ?&@
ch = {%QWy^ң1"u#d<)i[H-iG_
Hmmmm, okay, so that looks like binary data, and there's probably a second layer of either compression or encryption to this, and I may never be able to figure out what's encoded in there. However my suspicion is that there'll probably be a campaign ID (for the Buddha Stone campaign), which will let the server know which URL to redirect to, maybe an email ID (as one spam campaign might involve multiple emails), and probably my email address as well.
Okay, now we've hit that dead end, let's get back on track. Rather than clicking this link, because I don't want anyone adding me to yet another mailing list, I just searched Google for “Buddha Stone”, and pretty quickly found a website that looked just as retro as the email, at “freecharm.com/TheBuddhaStone/TheBuddhaStone.html”:
So, what is this weird, amorphous rainbow coloured blob they're selling (for NZ ~$160) that is able to fulfil my wishes? A quick Google image search, clicking the camera icon and then giving Google the URL of the image on the left, takes us to these results:
There are a few different options here, but it looks like our winner is probably rainbow hematite. Hematite, a form of iron ore, sells for about $150 per ton, but in this rainbow form I presume it's sold more for its beauty rather than its ability to be turned into steel.
This stone comes with a “portal plate”, seen on the right in the email and website images above, which is supposed to “charge” the stone. And, when I scrolled down the page, it turns out that for only US $285 they would also throw in their Wishing Machine:
Wow, 9 dials and a couple of pieces of thin metal sheet stuck to a wooden box, that will make my every wish come true using “radionics”. I'm not sure why I'd need one of these if I already have a Buddha Stone that will answer my wishes. More details are available at www.wishingmachineproject.com for those who are truly masochistic.
And that's not all. Visiting the front page of freecharm.com offers me (and you) a free gift. Apparently if you set this image as your laptop or phone wallpaper, it will “make everything in your life better” - because apparently it's the universe smiling:
And there's more! A banner at the top of the main page links to the Prayer Board.
This is currently at 50% off, at only US $99, so get in quick. The prayer board page also links to the “Psionic De-Materializer”, which includes “invisibility-cloaking" material, a "Key of Solomon" and “raw Black Tourmaline” (as well as some bonus dog tags):
Finally, at this page we link back to the Wishing Machine, and I've lost the will to go searching for any more of this nonsense.
All of this comes from one man, Joshua P. Warren. So, who is Joshua? IMDB tells me he's “a professional Paranormal Expert”, but that bio looks suspiciously like he wrote it himself, boasting of an Emmy award and his many appearances on TV:
A professional Paranormal Expert (ghosats, aliens, ESP) who produces and works as talent, Joshua P. Warren has appeared on the National Geographic Channel, History Channel, Discovery Channel, Travel Channel, SyFy, TLC, Animal Planet and many other networks. He is the author of more than 20 books, including Simon & Schuster's How to Hunt Ghosts, Pet Ghosts, Haunted Asheville and Use the Force: A Jedi's Guide to the Law of Attraction. He and his team made the cover of the scientific journal, Electric Space Craft, in 2004 for groundbreaking work on ghostly plasmas. He hosts the Joshua P. Warren Daily radio podcast, frequently appears on Coast to Coast AM, and owns the award-winning Haunted Asheville Ghost Tours in North Carolina. He lives in Las Vegas, Nevada, and a report featuring his paranormal work there recently won an Emmy.
Joshua also has a personal website, which is just as dated as all of his other sites selling his various magical machines. There's a short piece on Boing Boing about him from back in 2015, but it's mainly just pointing out that he's been selling the Wishing Machine and that it's nonsense.
From what I've managed to find online, it seems that Joshua has written a few books about ghosts, and made enough of a name for himself running a “mystery museum” and ghost tours in Asheville, North Carolina that he's been asked to be a talking head on programs on a few of the (mis)education cable channels in America. I was surprised to see that this line-up includes a low budget show that I've watched in the past called “Paranormal Paparazzi” (yes, it's just as bad as it sounds). So it turns out that I've seen this guy before, on TV, and now he's spamming me and trying to sell me snake oil devices that are going to make my wishes come true. It's a funny coincidence, but I'm definitely not going to take it as a sign from the universe that I should hand over my hard-earned cash to buy his nonsense.
