Sharing content, sharing reputation

Over at SpamResource Al talks about how sharing content is like sharing needles.

If you’re going to share email templates with somebody else, you’re sharing in their reputation. Lots of good spam filters, like those at Cloudmark, Brightmail, Yahoo and elsewhere, they use what is commonly called “content fingerprinting.”

Content fingerprinting is something that a lot of people don’t talk about. However, it is the logical next step to deal with spammers who spend a lot of time attempting to work around IP based reputation. It is also why a number of senders with good reputation can see random poor delivery.
The moral of the story is be careful of who you allow to advertise in or generate content for your newsletters. Otherwise, you may see your delivery suffer.

Related Posts

Spam that's not spam

Steve and I were talking this evening and I mentioned to him that I got “a lot of spam that wasn’t really spam. Know what I mean?”
He did. But if I tell that to you, what does it mean to you?
More on this in a couple days, but I’m onsite at a client’s for the next few days so it may take me a plane ride home to put all the thoughts down.

Read More

Beware: Phishing and Spam in Social Networks

Trend Micro warns us today about how spam and phishing can hit you even in the closed ecosystem of a social networking system such as Facebook. Malware abounds. And in the social network arena, just like anywhere else, “using your account to send spam” is a common thing for the bad guys to want to do.
In Rik Ferguson’s investigation (which I read about on CNet News), he came across a link to a URL that asked for his Facebook credentials, supposedly necessary to allow installation of a specific Facebook application. Once the credentials were handed over, the app immediately spammed all of his Facebook friends, sending them a bogus notification, attempting to draw them into visiting the phishing/malware URL, with (one assumes) the hope of spreading the infection even wider.
He’s a researcher for Trend Micro, so he knows what he’s doing. But for the rest of us, this highlights how necessary it is to be careful with who you give your usernames and passwords to. In my opinion, it’s never safe to take your username and password from one site and hand it over to another site. Some social networking make the problem even worse by blurring the lines between safe and unsafe by asking for usernames and passwords to third party accounts, but you just can never know with 100% certainty which sites are legitimate and which ones aren’t.
— Al Iverson

Read More

Email as a PR problem

Email is a great way to connect to and engage with people. It is also a medium where the sender doesn’t get to control the message as well as they might in other media. This means that sometimes email campaigns go wrong in a way that drives a national news story about how you are a spammer.
In the stress and flurry of dealing with public accusations of spamming many companies overlook the fact that the underlying issue is they are sending mail that the recipients don’t want or don’t expect. If there is a public uproar about your mail as spam, then there is a good chance something in  your email strategy isn’t working.
Even in the recent White House as spammers strategy, there is a strong chance that they are actually using reasonable and industry standard methods to collect email addresses. However, in their case, they are a large target for people to forge email addresses in forms. “Bob doesn’t like the president, but I’ll sign him up for this list so he can learn how things really are.” or “Joe doesn’t like the democrats so I’ll sign him up for their mailings just to piss him off.”

When you are confronted with an email campaign that upsets a large number of people there are a number of steps you should take.
Step 1: Gather information
This includes information internally about what actually happened with the campaign and information from the people who are complaining.
Externally: Get copies of the emails with full headers. If you’re working with people who do not want to reveal any details of the mail they received then you may not be able to fully investigate it, but if they do you will have everything you need right there. Figure out where their address came from (you do have good audit trails for all your email addresses, right?).
Internally: Talk to everyone who worked on that particular campaign. This includes the geek down in the IT department who manages the database. Figure out if anything internally went wrong and mail was sent to people it wasn’t intended for. I know of at least 2 cases where a SQL query was incorrectly set up and the unsubscribe list was mailed by accident.
Step 2: Identify the underlying problem
Look at all the available information and identify what happened. Was there a bad source of email addresses? Did someone submit addresses of spamtraps to a webform? Was there a technical problem? Again, talk to your people internally. In many companies I have noticed a tendency to try and troubleshoot problems like this at very high levels (VP or C-level executives) without involving the employees who probably know exactly what happened. This sometimes leads to mis-identifying the problem. If you can’t identify it, you can’t fix it.
Step 3: Identify the solution
Once you know what the problem was, you can work out a solution. Sometimes these are fairly simple, sometimes not so much. On the simple end you may have to implement some data hygiene. On the more complex end, you may need to change how data is handled completely.
Step 4: Inform the relevant parties of the solution
Make a statement about the problem, that you’ve identified it and that you’ve taken steps to fix it. How you do this is a little outside my area of expertise, although I have participated in crafting the message, rely on your PR folks on how to communicate this. In the Internet space, honesty is prized over spin, so do remember that.
Every company is going to have the occasional problem. In the email space, that tends to result in the company being labeled a spammer. Instead of being defensive about the label, use the accusation to drive internal change to stop your mail from being labeled spam by the recipients.

Read More