[TUHS] A Followup on Recent Malicious Unsubscriptions

[Warren Toomey via TUHS]

All, just a followup. Recently about six TUHS/COFF members e-mailed me
to say that thet had received a "confirm your unsubscription from the list"
e-mail when they clearly hadn't asked to unsubscribe.

For the last person, I was able to dig through the system logs and I
saw the unsubscribe request come from vaderetro-safeunsubscribe.com.

According to Google:

    vaderetro-safeunsubscribe.com is a domain used by the Safe Unsubscribe
    Service by Hornetsecurity (formerly developed by Vade, previously
    known as Vade Retro). 

    It automates one-click unsubscriptions from newsletters or commercial
    emails directly within webmail or email client interfaces, sparing
    users from hunting down tiny unsubscribe links at the bottom of
    messages. 

    The system detects unsubscribe options inside List-Unsubscribe
    headers or email bodies, then programmatically pings or triggers
    HTTP/HTTPS/MAILTO requests via its infrastructure to process the
    opt-out. 

I asked the last person and they say that they have never heard of this
service and definitely do not use it.

I've tried to contact vaderetro-safeunsubscribe.com about the issue and
I've had no response from them.

That's all I have: some new data about the issue but no resolution.

Cheers, Warren