Why are you spamming new user invites to people who never signed up?

[shawnyeager]

Among many others discussing it on nostr, I received one. It appears purposely deceptive in its construction to make it appear that I requested it.

[dmnyc]

I received one this morning in fact, sent to me for an app called Warpcast, which I had never heard of.

I would like to know how Farcaster obtained my email address and why they sent me an account verification email while I was still asleep.

Not cool, Dan. Not cool.

[vrypan]

It's probably not from Warpcast.
See this: https://twitter.com/fred_montagnon/status/1764316890195706062

[cboscolo]

It is more likely that this is a phishing attempt?

[vrypan]

I think so.

[dmnyc]

Some users are claiming the email addresses used were taken from the Ledger marketing hack. If this is what Farcaster is doing to boost enrollment, it's extremely unethical.

[vrypan]

Some less technical users are tricked into thinking this is a legit email from Warpcast.

Beware! It's phishing attack.

[shawnyeager]

The headers look legit to me. Here they are, in full. I've XXXX'd out my email address. Am I missing something?

Return-Path: <0100018e04364414-495425ff-9916-4091-834c-8fe75351aa1c-000000@amazonses.com>
X-Original-To: XXXX
Delivered-To: XXXX
Authentication-Results: mail.protonmail.ch; dkim=pass (Good 2048 bit
    rsa-sha256 signature) header.d=farcaster.xyz header.a=rsa-sha256;
    dkim=pass (Good 1024 bit rsa-sha256 signature) header.d=amazonses.com
    header.a=rsa-sha256
Authentication-Results: mail.protonmail.ch; dmarc=pass (p=quarantine dis=none)
 header.from=farcaster.xyz
Authentication-Results: mail.protonmail.ch; spf=pass smtp.mailfrom=amazonses.com
Authentication-Results: mail.protonmail.ch; arc=none smtp.remote-ip=54.240.9.91
Authentication-Results: mail.protonmail.ch; dkim=pass (2048-bit key)
 header.d=farcaster.xyz [email protected] header.b="jlUvjHN5"; dkim=pass (1024-bit
 key) header.d=amazonses.com [email protected] header.b="M8laGyo4"
Received: from a9-91.smtp-out.amazonses.com (a9-91.smtp-out.amazonses.com [54.240.9.91])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client
 certificate requested) by mailin047.protonmail.ch (Postfix) with ESMTPS id 4TngYt1njBz3d
 for <XXXX>; Sun,
  3 Mar 2024 12:07:30 +0000 (UTC)
Dkim-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
 s=6smfj73c5amia72szw2eapolvtgwocg4; d=farcaster.xyz; t=1709467649;
 h=Content-Type:From:To:Reply-To:Subject:Message-ID:Date:MIME-Version;
 bh=oFaCBtwMEPUFUZXXa2tv76MaWy/aAJxfIvi7C7ULLek=;
 b=jlUvjHN5Mh8xt2ZQoDst4hYvVDPFUi3nxX0/2T29yvEjW/oNfrTIoCXSk89IR8de
 uJEncxPVxqRDjTEywcuWjVUVuwHWKuk37bvwDHInxTdVtP31Q6yjRRlur6K6BxGie4W
 wDeDDCkUVhpZR49YyycnfexcRen69drt/hEAABIzE7vogp12Srxt3hGZJPn31jCdmh4
 TbAx2/IMirM3o+s3ngbGPsh1Z20z9sJDZ2yhbEzj2KaVQItXNbGXwbR0cvXgvi4Yc4q
 9OzqewaW53GjZu3gp4YdDvHZ13/+U9P5S0AO0ZoE6QAKg24FWzTz1oc7CElQwOhaKx/ ONrW5pllpg==
Dkim-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
 s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1709467649;
 h=Content-Type:From:To:Reply-To:Subject:Message-ID:Date:MIME-Version:Feedback-ID;
 bh=oFaCBtwMEPUFUZXXa2tv76MaWy/aAJxfIvi7C7ULLek=;
 b=M8laGyo4PgmCJ+nD4SpZNouKMWKD+Vg6GLnXNSPKcL29vbsLo0opg6W6OEvPWifD
 FRjai3G3QWfBOmhoKd8Yp25+9B2EOzLT0hcThTvMFRj1HPm3ZaQG4GaspkHXQF7WOnn
 rtcLDG2104bMsqQs8hzrZniM9d6CABg6iK0LxgZI=
Content-Type: text/html
From: Farcaster <[email protected]>
To: [email protected]
Reply-To: [email protected]
Subject: Verify your email address on Warpcast
Message-Id: <0100018e04364414-495425ff-9916-4091-834c-8fe75351aa1c-000000@email.amazonses.com>
Date: Sun, 03 Mar 2024 12:07:29 +0000
Mime-Version: 1.0
Feedback-Id: 1.us-east-1.XLbX3xkrSuczSsnwNV/TE2wGqF4+hzQTXmuE/M8u+xY=:AmazonSES
X-Ses-Outgoing: 2024.03.03-54.240.9.91
X-Pm-Spam: 0yezJI6cihyJeYR3pi42biOpJJvbmsCIeI1msjN3X3blJp7IjBlNIIojwsgjLlITJ
 otIjyi4MMwiiPJFUCR6II1LTQCJLU9kESB1XURJRRJQ1i04TOAjsk9lIWZ1J9pZ1vmZbIpj7SBlI
 0TiQsiOnzF9ccFGtwojIjLwAY4NTzDAONIz10YzNTM1UwiNCzF9ccFGthJ2X2ciUAuOj1DAMNgj4
 3MDMjM3UQxNj0TUNLJCw3N3XXajR90aFz19bcFGtwojIjLyQY4Mz1TEONcj3wcDMjNsIBfInp3dc
 dNGovR3X2Xul94YmwjoILAjwxEjNTNxcQxNj4jMNOcD1pJCLWbnF9uZVlW1YIoji0NHaWYrNZpX2
 fmVbdVHufRWZ2ctV9vaVlnNYcZnly8FZDMzIkxMDsyIMIJn1u9lbWYl1oiIjsWxYLZWl1RXYmczV
 wiIipWFbb9FjlRXY2Zy99teVl2RbbIC6h1mIWajxQuYXzmVYd5CwsICdmIh1xfaW02FYZdWvflnc
 mbtFI6ZSQlVIRFEUiMVRCLtJlsYWh2NXdVGn5J3b3XyBIib2ujAOOcT21gjMCLtJlsYWwzNXc9lt
 lR2bCb6I1hIm0WxaYcWuwxWYGauEtwY2sCIdI1mhfxWa3MyBByX3i2IbOEju91HMSfiwF0Y2vWdZ
 ckniVJiOEUBRVTVEiiwIcJ3p6ICZjI1YQ2ZT0DAOMEz3iZGMTNykJjODj2ZYMJy9zJCLSY6IJpey
 z19ccFGtwojICLzJ9yY2iWQZOAjuiwCO2cvNUicmujAOOwCiwVmc3b0Jp7IjDlJIVRkff5USVTQN
 tFSUy0gXIpjbuATLCMiwQuNTwjQMLkjugETOGbzlVkdGuGlIIdHsh1mLWazxlrcGuS5ZZQXiiwSX
 1UGBhFX0fE9TT9kO6ISRzWuA0sMFQlNIR9lQTNVQjIbpAuLTsF0MIhkFFRUQlUG99NUkJ0RXRZkF
 OVkUFVE91BT0TU5SIpjby4CMSXiwRNSFNF9TRNVTFdUQjIbp4wMCiSwXTBVBfRlUUQUxRJX0ikYR
 OslwdhjLCLEJlNS0J1NXR50F6ICRzWuA0sMVLkRIS1UfMFkVUSfRUiQVtlsOM4CxiwSXERJt9WTV
 JUxQR9FF6IiRyWw0FdLjECJLSl0NBZ1XETElpbIjuTALM0VsfRlI0UDNJPX0fFlRVVEYM9FVUSF5
 pbIjuTALM1F9iwSfnciMsiOnv2NccUmiy0iOjLsIJlInyG9cdIC6CJyeVQFl9IU1iU0QOsltw4yM
 CL5I45OSiSUOXwSiJZESFTFR9VUlfkxUT50M6ISWzWuEwiNC2C4MNMD21gjMDM3kkyMTdiJMLJCE
 SFUT1QQ9xJT0f1lQQxUMic1TlOts41MCmCJLYJXj0NXYXZuIl6eH1HFLYJXhpRnbmbiUwiXSQl9U
 QJVUE91UUSGZIiRVwlsOLQjs4YjIjLlA0sIlflJIUB1GMF0XETX9pbIjuTALMwiiwl2KDN1o4yNC
 uDANM4Cwx8CXDOjp0sIlflJIRtEJB9VTETPxI6Vywy0WLIjshZmImchNRlc34i5ceoX620zc2cm1
 czajhzVYblWhzJzNneycFwZW22xbddG3nN2bCNhxF6bWz25bZMXut92YnO9MI0Mj5TRaeEG13YHZ
 zY4JN3ej321bNBnlzFWdGdvV8ibmiSwXTlUNH9VR0TE9pbIjuTALMwSisVXbGdwlJ0YXhC9XbRHl
 h5mcGd2lx0ZS0XhZX9CwpFGbibdJJULCE19TT9lOF50TjIbp4wMCiSwXQNVObpjICMw4JhLC624c
 MQT2sgTMGIwlV0bm0jUOLIj044CMjLcBIxLzjCBLbV3u5JHdlOTV0sIlSkFIQ91O6ISQzWuA0sMF
 Jk1IUN1JfdkTEWf1EiVUwlsOLBjdNJCLUSF1RSX1FUNQIpjbw4CMCLwIssOirToMLID6dJifCLSJ
 BUQ1P0NXV5UUO90XSR6IAuWziCwMMJSdUJCL1TN9RDQVFF9STZlSUB1Q0XMFI6TCuzAWM0FsSZkI
 0Tf1FTSEO0RXIpjbw4CMSXiwVVTkMkFUXh0B6ISTyWw0AsLjwi0ILkj5dJyNCLSJBMRVPVRWXF0E
 fJFRVRfFJPRl6SITWAzus0FMlIDJRfVkV09QTRlfSVkWyT6IAuWziCwMMJCdGJCLkUN95FX0FV9U
 TZlGN9kUjIbp4wMCuCJLbR3pllmZkcmBJjYX0XNYZIXu6lHeDLxAAwMDlThMMQDz0QjNTMtQk1ND
 1DINZYmtxkTOiN00kxMDzTgLNMGtlZGOzNzUFhNTjTFYLATwwADMEMhBF6bWz25bZMXut92YlIs0
 hBIkS19URBVMPRVWjIbp4wMCuCJLbR3pllmZkcmBJjYX0XNYZIXu6lHelIs0RLIkfU1SVJFBiU0Q
 lOwsAsLjhmZIcNmhlR3cic45o6eXhyxKbFW6z52bXZuM9tY2iisOX1X9fQ==
X-Pm-Origin: external
X-Pm-Transfer-Encryption: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
X-Pm-Content-Encryption: on-delivery
X-Pm-Spamscore: 0
X-Pm-Spam-Action: inbox

[vrypan]

They look legit. (they are :-)

@varunsrin posted an update here: https://warpcast.com/v/0x497c8366

What happened?
Someone tried to sign up for accounts using known emails from data breaches. You can check if your email has been in such a breach on https://haveibeenpwned.com/
The goal is likely to figure out which emails already have Warpcast accounts.