August 15, 2003
Howard Dean Spam
Another blog buddy, Bill of yaak.net, sent along a note about some spam he recieved YESTERDAY apparently from the Howard Dean campaign. According to Bill, the email was sent to a known spam catcher address of his. The sender's address was dean@america.propulsive.net NOT from the deanforamerica.com domain. While I've seen stories about the Texas guy who spammed in Dean's name, this new spam does not appear related.
UPDATE 8/17/03: Just so we're clear, the following spam does not appear to be from emailresults.net. In addition, the Dean campaign has stated in a Slashdot comment that they contracted with two vendors, but have since terminated the relationship with them on 8/12. Note: prior to submitting the Slashdot story, the only outside knowledge of a marketing vendor was the earlier spamertized.org entry referencing emailresults.net. This joe-job entry about the spammer I am talking about was not even posted yet! As of this writing, the Dean campaign has not named the two vendors who they contracted with.
*****VIEW THE EMAIL HERE*****
I haven't seen the headers on the SPAM yet (blame the blackout), but here's some research on the alleged sender.
Update 8/16: Bill just sent me the headers for the email he recieved on 8/14. He also recieved a second spam from dean@for.accomplishing.net on 8/15.
Return-Path: <"dean@america.propulsive.net">
Received: from 109.ts8.increments.net ([69.41.70.109])
by BILL'S MAILSERVER (8.11.6/8.11.6) with SMTP id h7EL26R23408
for
To: BILL'S EMAIL
Date: Thu, 14 Aug 2003 17:12:08 -0500
Message-ID: <1060895528.4360@109.ts8.increments.net>
X-Mailer: Internet Mail Service (5.5.2650.21)
From: "DeanForAmerica.com" <"dean@america.propulsive.net">
Reply-To: "DeanForAmerica.com" <"dean@america.propulsive.net">
Subject: Presidential Candidate Gov. Howard Dean, M.D.
Mime-Version: 1.0
Content-Type: text/html
There is no Web page for increments.net, and the WHOIS information corresponds to the propulsive.net contact info found below. In addition, the 69.41.70.109 mailserver belongs to surfplex.net.
There is no Web page for propulsive.net, as far as I can tell. Also, look at the Google Groups results for the organization. Seems like an organization built to spam.
Whois Information
Registration and WHOIS Service Provided By: directNIC.com
Registrant:
Propulsive.net
21218 St. Andrews Blvd.
#415
Boca Raton, FL 33433
US
561-892-0937
Domain Name: PROPULSIVE.NET
Administrative Contact:
Administrator, Network postmaster@propulsive.net
21218 St. Andrews Blvd.
#415
Boca Raton, FL 33433
US
561-892-0937
Technical Contact:
Administrator, Network postmaster@propulsive.net
21218 St. Andrews Blvd.
#415
Boca Raton, FL 33433
US
561-892-0937
Record last updated 04-02-2003 11:28:42 AM
Record expires on 03-31-2004
Record created on 03-31-2003
Domain servers in listed order:
NS0.PROPULSIVE.NET 69.41.69.11
NS1.PROPULSIVE.NET 69.41.69.12
Doing a reverse IP WHOIS lookup on the propulsive.net DNS servers, brings us to some ISP called surfplex.net with the upstream proider called fastduck.net. Here's the WHOIS info for surfplex.net.
While surfplex.net doesn't appear to have a working Web page, the upstream provider fastduck.net looks a little shady. Here is the WHOIS info for fastduck.net. Here are the GOOGLE results for fastduck.net and the GOOGLE GROUP results. Take a look at this interesting newsgroup message about spamming from surfplex.net/fastduck.net.
So, just to reiterate, the original mailing domain was propulsive.net, which has the upstream provider of surfplex.net, which has the upstream provider called fastduck.net. Also, it appears that higher in the upstream chain that fastduck is partnered with cogentco, a notorious spamhaus.
So I suppose the real question is how did a spamhaus (I think that's undeniable at this point) start spamming in Howard Dean's name? How did they get Bill's address? Who authorized this and who is paying the spammers (because they don't do this without the cash)?
Update 8/15: The SPEWS file on that surfplex.net mailserver. This file is huge.
Update 8/16: View the html source of the email. Check out the link to http://www.deanforamerica.com/registrese. Clicking on a hyperlink in the "note", it seems that there is a redirect through some service called eScriptions.net to the official Howard Dean Web site. (WHOIS information.)
Also, the images in the email are being served by a domain in Venezuela called creative-server.com. (WHOIS information and some Google Groups results for creative-server.com domain.) Here is an example of an image from the email. Oddly enough, the DNS servers for creative-server.com belong to an outfit called secure.net (nice shady Web page), which if you a Google Groups search on them, you see posts like this gem.
So I suppose the "best" spin that the Dean people could give this is that they partnered with eScriptions and they "had no idea" eScriptions would use shady spammers to deliver their message. And if the campaign didn't partner with eScriptions, you would think that a Dean Web developer would be asking why the campaign sign up site was receiving visitors from those eScriptions redirect links. But still, I wouldn't have thought that net-savvy folk would market their message in this fashion. *ahem*
Update 8/16: It appears that the Dean campaign is outsourcing email. Take a look at this analysis over at spamvertized.org concerning emailresults.net.
Tristan Louis has written about his Dean campaign spam here, here, here and here.
Posted by joy at August 15, 2003 12:41 PM | TrackBackAre you sure someone ELSE isn't doing this just to create controversy and tarnish Dean's image?
Posted by: Mike at August 17, 2003 04:33 PMI'm sure Dean loves the fact that he is being disparaged on slashdot because of some lying spamhole. They do not allow unsolicited email.
Posted by: Jeff at August 17, 2003 04:59 PMDid you ask the Dean campaign for comment before publicizing this stuff? YOUR credibility is at issue.
Posted by: Bob at August 17, 2003 05:25 PMYup, the friend who forwarded the spam wrote the campaign an email last week, and has not gotten a reply as of this writing.
You can read his point of view about this on yaak.net.
Posted by: joy at August 17, 2003 05:32 PMJoy, you might want to add more prominence to the fact that the campaign admitted to partnering w/ said company, and quickly severed the relationship as soon as they were shown to be spammers. Poor decision to start the relationship in the first place? Yes. But it might be fair to not bury the ending...
Posted by: Dana Powers at August 17, 2003 05:52 PMDana, it's my understanding that emailresults.net (the spam that spamertized.org dissected) and the eScriptions.net spam above are NOT RELATED. I suppose that they are the two vendors that Nicco referred to in his slashdot post, but he hasn't named the vendors as I write this. Additionally, Nicco said that the Dean campaign knew about spam being sent on their behalf on August 12th, while the spam discussed above are dated August 14th and 15th.
That being said, I'm watching the slashdot discussion like you are and I will happily post a "It's resolved" link once I'm sure of the identities of the two vendors.
Posted by: joy at August 17, 2003 06:07 PMFunny to see the Dean supporters slamming the facts. Get over it, admit it, and get on to something else. The Dean campaign's reputation for being "net-savvy" does not need to demonstrate "internet harrassment" as well.
Posted by: Scott at August 17, 2003 07:24 PM"Tech Savvy" doesn't mean anybody in the Dean campaign knows anything about the nuts and bolts of how the internet works. They're end users for the most part, and are probably surprised that this is happening.
I'm a Dean supporter, and I'm disappointed in the spam thing, but I am willing to give them the benefit of the doubt.
Don't disregard a good candidate who has really tried to serve the internet community that has built up around hs campaign because of something the campaign probably had nothing do to do with.
Posted by: ACW at August 17, 2003 09:35 PMAre you guys serious? We're talking about a political scene in which an administration taking energy policy advice from Enron, lies about WMD, phony intelligence etc. leading the country into War is glossed over as business as usual in this cutthroat world. And your attacking a candidate for having at worst poor Internet etiquette?
Weird sense of priorities is all Ive got to say
OMG, you write someone on Friday that you know gets a ton of mail and post this material the same day without waiting, and expect a prompt response over the weekend? Are you for real?
I mean, at this point, why respond to you? He's better off waiting for reputable news media to pick up this story and give a response to them.
Posted by: Bob at August 18, 2003 12:50 AMBob, I think you answered your own question as to why no initial response from the Dean campaign. I too believe that unless mainstream media picks up the story, we won't be hearing much from the campaign.
Also, I don't believe for one second that my friend is the only person who saw this second type of spam (NOT from emailresults.net), so it was only a matter of time before *someone* asked those questions.
In a way, it's better for Dean that a lowly geek blogger asked first rather, than, say, the tech writers for the Washington Post or [insert your favorite mainstream news source here] or some non-informed political pundit who will spin it like a top.
Posted by: joy at August 18, 2003 12:59 AMSomething to note. Everything I've posted about the subject have been undeniable facts. In both posts, I've included the headers, the underlying HTML source and the spam. Go and take a look at the (immediate) senders yourself.
At this point, I still believe that the email referenced above has nothing to do with emailresults.net (the dates on the spam referenced above are 8/14 & 8/15 while the Dean campaign apparently stopped dealing with their unnamed vendors on 8/12), and that's why I raised the question about the origination of the spam to Slashdot.
So, personally, I was glad to see someone from the Dean campaign post on the Slashdot thread. The posting didn't answer all of my questions, but at least it was a start.
I got spammed from dean too.
From: DeanforAmerica.com
Subject: [SPAM] Presidential Candidate Gov. Howard Dean, M.D.
Mime-Version: 1.0
Content-Type: text/plain
X-Spam-Status: Yes, hits=9.3 required=5.0
tests=ACT_NOW,BIG_FONT,CLICK_BELOW,CTYPE_JUST_HTML,DEAR_FRIEND,
DEAR_SOMEBODY,EXCUSE_3,EXCUSE_7,HTML_COMMENT_UNIQUE_ID,
NORMAL_HTTP_TO_IP,RCVD_IN_OSIRUSOFT_COM,SPAM_PHRASE_05_08,
US_DOLLARS_4,WEB_BUGS,X_OSIRU_SPAM_SRC
version=2.44
X-Spam-Flag: YES
X-Spam-Level: *********
X-Spam-Checker-Version: SpamAssassin 2.44 (1.115.2.24-2003-01-30-exp)
X-Spam-Prev-Content-Type: text/html
Status:
SPAM: -------------------- Start SpamAssassin results ----------------------
SPAM: This mail is probably spam. The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM:
SPAM: Content analysis details: (9.30 hits, 5 required)
SPAM: US_DOLLARS_4 (0.4 points) BODY: Nigerian scam key phrase ($NNN.N m/USDNNN.N m/US$NN.N m)
SPAM: EXCUSE_3 (0.4 points) BODY: Claims you can be removed from the list
SPAM: EXCUSE_7 (0.4 points) BODY: Claims you can be removed from the list
SPAM: DEAR_FRIEND (0.4 points) BODY: How dear can you be if you don't know my name?
SPAM: CLICK_BELOW (0.3 points) BODY: Asks you to click below
SPAM: ACT_NOW (0.3 points) BODY: Act Now! Don't Hesitate!
SPAM: DEAR_SOMEBODY (0.1 points) BODY: Contains 'Dear Somebody'
SPAM: SPAM_PHRASE_05_08 (1.6 points) BODY: Spam phrases score is 05 to 08 (medium)
SPAM: [score: 5]
SPAM: BIG_FONT (0.3 points) BODY: FONT Size +2 and up or 3 and up
SPAM: WEB_BUGS (0.2 points) BODY: Image tag with an ID code to identify you
SPAM: HTML_COMMENT_UNIQUE_ID (0.1 points) BODY: Contains a comment with nothing but unique ID
SPAM: NORMAL_HTTP_TO_IP (1.3 points) URI: Uses a dotted-decimal IP address in URL
SPAM: RCVD_IN_OSIRUSOFT_COM (0.4 points) RBL: Received via a relay in relays.osirusoft.com
SPAM: [RBL check: found 154.69.254.208.relays.osirusoft.com., type: 127.0.0.4]
SPAM: X_OSIRU_SPAM_SRC (2.7 points) RBL: DNSBL: sender is Confirmed Spam Source
SPAM: CTYPE_JUST_HTML (0.4 points) HTML-only mail, with no text version
SPAM:
SPAM: -------------------- End of SpamAssassin results ---------------------
d, you don't possibly have access to the full headers on that email message?
It would be interesting to know the date sent and wether or not it was sent after 8/12/03.
Posted by: joy at August 18, 2003 02:06 AMThe following is what comes on REAL DFA emails.
>>>>>>>>>
Paid for and maintained by DEAN FOR AMERICA
Contributions to Dean For America are not tax-deductible for federal income tax purposes
>>>>>>>>>
IF it were really from the campaign I am sure they wouldn't change this, because this is what the FEC requires.
It would not be hard for the Republicans, or DLC or DNC to pay a Spam company to spam in his name so as to slander the "Internet" Campaign in the worst way you could.
I doubt very highly this is a real DFA email. To me it has all the signs of being a spoof. Just like the fake PayPal emails, Ebay emails, etc... that have a few real links to the real webiste intermixed with thier own false links.
Charles Goin
Posted by: Charles Goin at August 18, 2003 08:19 AMCharles, that is an interesting point. I just re-checked the spamvertized analysis of the emailresults.net spam and couldn't find that statement on that spam either.
On the spam that I posted, on the bottom there is a "Paid for by Dean for America" statement but not what you quoted.
Any word from the Dean people on wether or not the two unnamed marketing vendors they did partner with used that particular language in the disclaimer?
Posted by: joy at August 18, 2003 09:08 AMjoy, my mistake - I did not realize that there were 2 separate incidents. I haven't seen the responses in the slashdot comments that you mentioned, so I guess I'll be waiting for something more official.
Posted by: Dana Powers at August 18, 2003 11:13 AMI just wanted to note that an unofficial explanation of the spam was posted at Dean2004.blogspot.com.
Posted by: joy at August 18, 2003 10:08 PMHi guys, I am the CEO of EmailResults.net. Ya, no kidding. I founded the opt-in business in 1997 by working with teams of intelligent people like yourselves who also hated spam but knew their could be a legitimate industry for relevant marketing content based on individuals true interests. I can tell you we do not run and hide with fake headers, hijack mail servers or deliver irrelevent "get rich quick scams" or porno crap.
We are and were one of the two vendors Dean recruited. However, the error that Dean made was to use any company sourced out of Boca Raton for email marketing. They all use the Naviant untargeted list of 100 million email names harvested in 1998 by eDirect.
I formed an alliance with Jim Nitchels, one of the original founders of CAUCE (now deceased) in 1997 to create the industry. Walt Rines (brother and Sanford Wallace) was also involved but were two conceited people who did not care about real relevence in email marketing and did not want to pay a penny to network admins like yourselves who were and are trying to protect individual rights of privacy and keep your networks up and running. I took the time to understand the real issues by listening to the sys admins and create and industry that once again is being pissed on by greedy people.
The premise of "opt-in" email marketing as defined by the spam advocy groups and myself at the time was about:
1) Delivering relevant content to individuals who have stated an interest in a product or service
2) Have given true consent to receive messages
3) Paying the networks for bearing the burden of legitimate marketing messages.
4) Parterning with such companies to receive the demographic and interest points of each subscriber then sending a confirmation to the subscriber confirming relevant interests BEFORE marketing piece one went out.
I have three of four legitimate competitors who still actually conform with such standards. However, the other hundreds who have a website and sell email marketing, do not adhere to such practices. Therefore, companies and politicians alike invariably make the wrong choices and recruit companies which are completely shady. It's a shame and a learning experience for Dean no doubt, who is a good man trying to tackle some tough issues.
I invite additional posts, direct dialogue and your feedback as I have recently become involved with again trying to tackle the problem of defining to the nation what legitimate email content is vs. spamming. If we want a true solution, it will be those of us that run the networks and Internet and gets it done together as it happened in 1997.
I can tell you the biggest challenge I have seen to change the industry. It is the attitude of big business who feel they do not have to pay delivery services to send legitimate email content over the networks. I find this baffling as TV advertisers pay ABC, NBC, MTV and other major netowrks to deliver the message over the air. Same with radio. Direct postal gets delivered over the US Postal Service who is getting paid to do this. Why do we not have any real action happening about really killing spam and defining legitimate newsletter, marketing content? Greed from big business. This should change and can change but requires an alliance similar to the one I spoke about in 1997. The true solution of killing spam is to bring big business and the major netorks together which I helped facilitate in 1997. There are plenty of technical solutions to monitor and filter junk mail vs. legitimate email content. However, you can use the drastic technology measures until big business and the networks decide what relevant content is vs. spamming. It is the definition that is lacking.
Good luck to you all. Figured I would lend my two cents into this discussion.
Best Regards,
Jason C. Rines
CEO
EmailResults.net
Dean, the "Internet Candidate"? Yeah, right. He'd know everyone HATES spammers.
And then he tries to blame the contractors...hmm, considering this is the second time he's been caught, I doubt it.
You don't just accidently hire a spamming company as your consultants.
Dean campaign admits to using spam
http://www.msnbc.com/news/954100.asp?0dm=C24EN
Cogentco is not a blatant spamhaus.
They're a rather big network provider, who have a serious spam problem.
Those two things are not the same.
A mere association to a network provider with a spam problem, does not a spammer make.
Posted by: AntiSpam at August 20, 2003 04:07 PMJason Rines, known spammer, CEO of a known spamhouse, brother to notorious spammer Walt "Picklejar" Rines, friend of former king of spam Sanford "Spamford" Wallace, writes that
he founded Opt In.
Yeah, and I invented the internet.
Sorry, but he's a slimeball spammer, with slimeball friends, and anyone who googles will find that emailresults.net has a long history of sending spam. Knowing how Spamford and Picklejar worked, I suspect Jason owns pieces of most of those Boca Ratan spamhouses that he says you shouldn't use.
Posted by: NoSpamForMe at August 20, 2003 05:26 PMYou anti-spam purists frighten me. On an almost monthly basis I recieve unsolicited phone calls and home visits from various environmental, workers, childrens and oppressed/disadvantaged peoples advocacy groups, they are on a shake down mission. The causes they represent need money to fulfill their goals. Long term experience shows that "gettting in the faces" of people yields the biggest results. Many are pissed off at the tactics and don't donate.
Since a much larger percentage of their contacts don't donate because they simply don't want to and offer reasons like, "I gave at the office", "I just lost my job" or "I give to another better managed organization", they don't care about the people who say they don't give because they don't like the unsolicited in your face tactics, they simply write them off as more mud on the tires.
The same will become true of this anti political spam tirade I'm sure, if the spamming works (meaning it expands the political/financial base of the candidate employing it) the anti spam snobs will simply be whiners that must be smiled at and apologized to as they continue to employ whatever tactics get the best most cost effective results.
Posted by: jim at August 22, 2003 03:09 PM