Fight for the Future: Political spam
Fight for the Future, a non-profit formed in late 2010, is spamming addresses that are very unlikely to have anything to do with U.S. politics anyway and that, if they’re real, stopped existing years before Fight for the Future was formed. The ESP is SendGrid. The realnames seem real enough, the addresses seem made up. I wonder if this is a case of malicious forge-subscriptions. If that is so, practicing confirmed opt-in would have prevented this. The message itself does not shed any light on the address list building mechanisms of this sender.
Spamming IPs: 50.31.40.130, 50.31.40.131, 50.31.38.99, 50.31.39.181
Sample spam headers:
From bounces+x-x-x=x@list.fightforthefuture.org Fri Apr 6 19:xx:xx 2012 Return-Path: <bounces+x-x-x=x@list.fightforthefuture.org> Received: from o18.list.fightforthefuture.org (o18.list.fightforthefuture.org [50.31.39.181]) by x (Postfix) with SMTP id x for <x>; Fri, 6 Apr 2012 19:xx:xx +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=fightforthefuture.org; h= content-type:mime-version:subject:from:to:date:message-id :reply-to:list-unsubscribe; s=smtpapi; bh=gb+jtc54C6bDQMlqc74Pze 0vCL4=; b=FyVsot7gesf7vpC7aswYQdVXebJzvlp+g1yhZGYoMM+o2dqBEj+A9k PRzFXDU79foMK3z5gBsqyEDPt01hUO2PLzCLsk0e7BVmKv85eG2OPodqfDxdxeu/ TLcBAYf5dCMqIPVcC+gLsg6GWN1Uc82AqA2xYdEKc8ZQbsj3j4tGI= Received: by 10.8.49.76 with SMTP id x.x.x Fri, 06 Apr 2012 11:xx:xx -0500 (CDT) Received: from outbound.actionkit.com (unknown [10.9.180.5]) by mi2 (SG) with ESMTP id x.x.x for <x>; Fri, 06 Apr 2012 11:xx:xx -0500 (CST) Content-Type: multipart/alternative; boundary="----=x" MIME-Version: 1.0 Subject: Obama AFK? From: Tiffiniy Cheng <info@fightforthefuture.org> To: x <x> Date: Fri, 06 Apr 2012 16:xx:xx +0000 Message-ID: <x-x-x@list.fightforthefuture.org> Reply-To: Tiffiniy Cheng <info@fightforthefuture.org> List-Unsubscribe: <mailto:unsub-fftf-x-x.x@fbl.actionkit.com> X-Sendgrid-EID: x X-Sendgrid-ID: x Content-Length: 15317 Lines: 294
Human-readable spam contents:
[1]Let’s get more signatures than any petition on whitehouse.gov.
[2][IMG]
Dear X,
Can you believe this? After the largest online protest in history, the
Obama administration is still voicing support for SOPA.We promised to ask for your help if SOPA returned. We’re asking now. This
kind of backtracking demands a strong, fast response. We’re running a
petition to demand that Obama drop all support for internet censorship.Our goal? Get more signatures than the top petition on whitehouse.gov —
151,000 signatures. [3]Tell Obama to promise: “I will never advance
legislation that blocks websites or disconnects Americans’ internet
access.”What is the White House working on exactly? Just the other day, the
administration sent a letter to Congress to demonstrate their support for
new internet censorship legislation. A few weeks ago, the White House
struck a deal to give corporations private powers to shut down your
internet connection (after “six strikes” without due process or judicial
review), completely in secret.Obama’s internet would let private companies block sites and turn off our
web connections. Blocking websites censors free speech, hurts jobs, and
breaks the internet. These are tactics used by totalitarian governments
and we believe they’re never ok.[4]Let’s get more signatures than any petition on whitehouse.gov.[5][IMG]
As Wired noted*, “The White House did say that it wouldn’t endorse a bill
that endangers freedom of expression, increases cybersecurity risks, or
negatively affects the DNS system. On the other hand, it says elsewhere
that “combating online infringement” — not protecting free speech — is a
governmental priority “of the highest order.” What about free speech,
Obama?[6]Sign the petition now, then share it to keep the internet strong. Our
friends need to know where the President is currently standing on SOPA.We couldn’t have stopped SOPA and PIPA without you and all of your
friends! And we can’t do it without you now. Let’s make sure SOPA 2.0
never gets written.Thank you,
Tiffiniy, Zak, Fight for the Future!
[7]Share this on Twitter [8]Share this on Facebook————————————————————————–
* The Wired article can be read in full here:
[9]http://a.fightforthefuture.org/go/21?akid=x&t=1To learn more about the White House’s support of internet censorship, see
this article on CNet:
[10]http://a.fightforthefuture.org/go/21?akid=x&t=2References
Visible links
1. http://a.fightforthefuture.org/go/20?akid=x&t=3
2. http://a.fightforthefuture.org/go/20?akid=x&t=4
3. http://a.fightforthefuture.org/go/20?akid=x&t=5
4. http://a.fightforthefuture.org/go/20?akid=x&t=6
5. http://a.fightforthefuture.org/go/20?akid=x&t=7
6. http://a.fightforthefuture.org/go/20?akid=x&t=8
7. http://a.fightforthefuture.org/go/22!?akid=x&t=9
8. http://a.fightforthefuture.org/go/23?akid=x&t=10
9. http://a.fightforthefuture.org/go/21?akid=x&t=11
10. http://a.fightforthefuture.org/go/21?akid=x&t=12You can unsubscribe from this mailing list at any time:
http://a.fightforthefuture.org/cms/unsubscribe/unsubscribe/?akid=x&t=13
Some of the spam might have been due to forge-subscriptions, Atro, but not all of it. They also reactivated email addresses that had unsubscribed, including my own, from their last big mailing run a month ago through Blue State Digital. They also hit a number of my spamtraps at domains that are not known to be spamtraps, unlike yours.
I can’t imagine that, after the complaints and SBL listings from that mailing (which appears to have caused Blue State Digital to boot them), they didn’t know better than to respam the same list and (this is the kicker) IGNORE ALL PREVIOUS OPT OUTS, but they did. 🙁 Under the circumstances, I suspect that they purchased a Millionez CD or something like it.
We say in America that “There is no fool like an old fool”, but young fools can be even more amazing in their foolishness. It is a real pity, because the cause that they claim to support is one of my causes too. However, anybody who thinks that having a good cause means you can spam is a fool. I hope somebody less foolish takes over this cause.
Gee, that’s really depressing. Wonder what SendGrid has to say about this, then. I guess I should set up a separate feed to identify mail sent to the Finnish equivalent of the Millions CD…
I tweeted your blog, Sendgrid tweeted back that they’d dealt with the spammer. I also checked Spamhaus, and lookie here:
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL135418
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL135419
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL135420
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL135421
Apparently our friends at Spamhaus got spammed too. And are *just slightly* annoyed.
Hi everyone, Holmes here from Fight for the Future.
Back in January we decided to move to a new service (Action Kit) for sending emails. During that process, we asked our former provider (Blue State Digital) for an export of subscribed users only. Instead, they gave us an export that included all users, and as a result, our last mailing went to every one of the 84,000 people who had unsubscribed from our list along with all bounces. This makes us feel sick. To everyone that happened to, we’re so sorry. It will never happen again.
The email also went to ~33,000 addresses from a signup page that we knew had been hit with harvested submissions, and that we’d agreed with Spamhaus back in February to remove.
We just posted an apology and full reckoning here and tweeted it to our users. There are a ton of important details that relate to the comments here, so I’d urge anyone reading this to read it:
http://fightforthefuture.org/apology
We sent the above to Spamhaus yesterday (and Sendgrid) and they’ve since removed their block on us, though understandably after an error like this we’re on our last strike. We take this extremely seriously and have already put a huge amount of work into setting it right, with much more left to do.
Incidentally, we left Blue State Digital on good terms, and had already signed a contract to migrate before we first heard from Spamhaus. I’m sure they’d be happy to verify this. Our friends at the EFF can vouch for our intentions and ethics. We realize the migration error was a huge mistake, and that disclosure without COI is not considered a good practice here. But we’re not a malicious actor or a fly by night group. We’ve resolved the migration error, and we’re working on confirmed opt-in.
If anything needs clarification, or if there’s something you think we should be paying attention to that isn’t covered here, please write us at: repairs@fightforthefuture.org