The blogswarm against theocracy will begin this Sunday, July 1, and will run through Wednesday July 4. Follow these instructions to participate: 1. Post to your blog about the separation of church and state. via I Speak of Dreams
Read More… (From Email Spam News)

As part of my massive spam/ham tracking project, Ive been signing up for lists. Hundreds of lists. Somewhere north of four hundred and I keep adding more every day.

Im practicing safe signup each retailer, newsletter publisher, media outlet, or other list owner gets a unique address that isnt easily found by way of dictionary attacking. Ive got multiple domains and the ability to bounce/filter out certain addresses. Thankfully, too, as theres already a few senders who have done things with the addresses that I dont agree with. Theyre no longer a part of the feed, as I dont consider them good senders.

This isnt exactly shout it from the rooftops fun to do. Id much rather be over on Navy Pier, relaxing at a table in the beer garden, with some sort of tasty beverage. But, its been providing me with good, useful data, and for the most part, Im able to stand the monotony of signing up for list after list after list after list.

What really is dragging it down for me, though, is excessive profiling. Im not new to marketing. I know profiling is good. I love self selection and self segmentation. Let people tell you what lists they want to be on. Its wise. It puts the consumer in charge of the messaging. Let them hear what they want to hear about, and itll make them happy. Dont offer that capability, or dont utilize the data youre collecting, and you end up looking silly. Heck, get it wrong enough, and people are even going to blog about it. Heh.

But some of these sites go overboard with five and six page surveys. Screen after screen of required fields and tell me more about yourself. Dude, I just want to receive your newsletter. Im not applying for a car loan. Sure, I’m subscribing for a unique purpose when compared to most other newsletter subscribers, but is it really that different? When I sign up for something for myself (XM Radio, technology newsletters, etc.), my eyes start to glaze over if they want to ask more than ten questions (and Im counting enter your email address twice as two of those).

How can people stand these? If my office had a window I wouldve jumped out of it rather than finish the most recent of these long, slow forms that I just came across. And I can’t be the only person who feels this way.

I just cant help but wonder about the drop off rate is for these long, multi-page survey-based signup forms. I bet its fairly significant. If your prospective registrant gets bored and wanders away mid-process, youve lost a chance to sell to him.

Read More… (From Al Iverson’s Spam Resource)

July 1st, 2007 I’ve received lots of e-mails from customers who want to run SpamSieve on an iPhone . via C-Command Blog
Read More… (From Email Spam News)

Patrick Writes,

Hi. I like your blog! I run a doctor search engine, a new business looking to run a legit email campaign to get the word out to doctors. I don’t know where to turn or who is legit, etc. Can you recommend anyone? Thanks for any help or referrals, etc.

Hi Patrick,

Thanks, glad you like the blog! I know it’s tough starting a new site or business and trying to get the word out. I’ve helped others do this before, and there are actually quite a few things you can do.

As far as doing email campaigns, let’s start with what you shouldn’t do. Don’t harvest email addresses. Harvesting addresses involves using software to find email addresses out on the internet and add them to your email list. Those people didn’t opt-in to get mail from you, so if you send mail to lists like that, you’re going to end up blocked fast and far and wide. It’s spam, plain and simple, regardless of how well targeted it is. Don’t buy lists either. There’s no such thing as a guaranteed opt-in list for sale. The people on those lists don’t know you, don’t recognize you, and aren’t keen to hear from you they’re already getting tons of unwanted spam from every other fool that bought that list. I can guarantee that such a list is going to garner more spam complaints than new visitors to your site.

If you want to get the word out via email, the way to do it is by partnering. Find sites that cater to doctors and find out what advertising opportunities they offer. I don’t know a ton about this space, but a quick search says that WebMD, OneHealth, and Medscape might be places to start. Will they send an email to their list on your behalf? This type of third-party emailing is legal and common, though it can get spendy. Ask them if it’s okay to send them press releases maybe you can generate some buzz that will cause them to write articles about you, and get you free traffic and interest.

You could also partner with a list rental firm. I’ve guided clients toward Return Path’s Postmaster Network in the past, with good results. I find them to be very reputable. Beware, though. For every good Postmaster Network, there a thousand fly-by-night firms whose lists aren’t truly opt-in and who turn out to be run by people whose ethics are questionable. I’m technical enough that I’ve caught list rental brokers trying to deceive my clients with falsified proof of opt-in details (No, this Michigan RoadRunner user did not opt-in from an IP in London), or proof of delivery (no, an SMTP transaction handoff does not mean the recipient received it and therefore opted-in). Etc. The space is filled with bad guys changing company names every few months, selling opt-out access to lists compiled from questionable methodology. My recommendation would be to get references from anybody you’re going to go with, and force the vendor to use an opt-in process, instead of opt-out, if the process involves the people being able to sign up to get emails from you later. With opt-out, the match rate is higher, and you will pay the list rental vendor more money. But, the complaints will be higher and you’ll end up angering some important ISP like AOL and having to opt-in those names later. (Throwing away 90% of them in the process.)

Besides email campaigns, organic search is very important. If your field is unique enough, or you can find a unique enough angle, this actually can work pretty well. Start a blog or a content site. Write and post intelligent and relevant articles on the topic in question. Link to it legitimately by participating in blog and online forum discussions on the topic. Link back to appropriate content on your sites, but only in the context of the discussion. (Don’t just post and say things like, Hi! Great discussion. Visit my site at www.domain.com for more info! That’s pretty close to blog spamming, and if it happens enough, Google will end up removing your site from their index. When that happens, the results are devastating and it can take months to clean up. )

Hope that helps! And thanks for your question.

Read More… (From Al Iverson’s Spam Resource)

Double opt-in, confirmed opt-in, email address verification, whatever you call it — nobody ever universally agrees on whether or not you should do it. I see a lot of people in the anti-spam community try to recommend it based on their feelings. They relate specific experiences where a company annoyed them by not confirming subscriptions. Interesting, but it doesnt always speak to senders in the language they need to hear. Unhappy anecdotes dont provide the necessary info to convince marketers, who generally work by way of a data driven decision making process.

• What makes response rates go up and down?
• Whats the risk of not doing double opt-in?
• How does it actually correlate to lost sales or lost revenue opportunity?

Because youll get blacklisted is often thrown around as a reason to do double opt-in. The simple fact of the matter is, thats not a good enough answer any more.

A lot of blacklists will list you only for not doing double opt-in. Does it hurt? If they list you, youre cut off from only the lists users, and the more draconian lists that do that are generally very lightly utilized, having absolutely very little effect (if any) on deliverability and email performance. If you cant measure it, it doesnt matter.

Reading around today, I ran into this: Two marketers, talking about double opt-in. One making the case for, and one making the case against. Both, actually, have some valid points, and are worth checking out.

Its nice to see that in some instances, a double opt-in model can be shown to improve ROI. This is important data that more anti-spam groups and double opt-in advocates need to collect and publicize. It speaks to marketers in their own language.

Its also true that double opt-in isnt perfect, from a marketers perspective. Not everybody can figure out how to confirm, no matter how easy you make it. And, confirm emails get eaten by bad spam filters sometimes, just like regular emails.

With all of that in mind, can you make double opt-in work for you? Have you tested it recently? If so, what were the results? If not, what about it didnt work for you?

Read More… (From Al Iverson’s Spam Resource)

Q: How long does it take a new Gmail account to get spam?
A: In my case, one day.

May 26: Create account. Address has never been given out to anyone.
May 27: Receive weird spam in Chinese.

Q: How long does it take for an address, published on the web, to be harvested?
A: In my case, two days.

May 26: Create email address at (non-webmail) domain. Post address on one website.
May 28: Receive weight loss spam and fraudulent lottery notifications, to that address only. And fourteen spams since.
Read More… (From Al Iverson’s Spam Resource)

I loved this post, and here’s what I loved about it:

[The prospect who got himself blacklisted] thought he could solve all his problems if he switched to MailChimp, because we apparently have a good reputation, and because he thought we had some kind of secret-handshake arrangement with ISPs (actually, that’s not the case—they’ll blacklist anybody that generates too many spam complaints).

Ben @ MailChimp is 100% correct. ISPs will block and blacklist you, regardless of who your email service provider (ESP) is, or what IP address you send from. And they’re smart enough to figure it out when you change ESPs. If they blocked you at the other ESP, it will take anywhere from immediately to very soon before they find you and block you at your new home. Your reputation follows you. You’ll hit the same spamtraps, have the same volume of complaints. Since these are what drive ISP blocks, switching ESPs isn’t going to magically wash all that away.
Read More… (From Al Iverson’s Spam Resource)

It dawned on me today that I haven’t been logging the recipient addresses identified in the spam messages I’m cataloging and reporting data on. I think it’d be a good idea to expand my data set sideways and start adding that info, as spot checking the data has been quite insightful. I’ve found, for example, that spammers are dumb enough to harvest from Google Groups, because I have a fair number of recipient addresses with … in them, indicating they were truncated versions of real addresses I used when posting to newsgroups years ago. Then there’s lots of spam directly to those newsgroup-harvested addresses, spam to addresses obviously harvested from the web, spam hitting abused co-reg addresses, and god knows what else to actual once-valid but long-dead actual user addresses.

There’s one alias that is getting just a metric ton of spam, and the construction of the username portion makes it clear to me that it was an alias I gave to somebody and they misused it, or somehow leaked it to some real bad dudes. I wish I could remember who I gave the address to but that info is stored on a drive pulled from my old unix server when I moved to Chicago. I’m dying to know which random bad actor is responsible for that bit o’ feed, because the mail it’s getting is so far from CAN-SPAM compliant that it’s not even funny.

Even though I’m getting more than six thousand spams a day, I’ve only been tracking an average of 2200 a day for the past forty-one days. At first I had to do a lot of manual review of the spam to ensure that it wasn’t accidental ham, there was a fair amount of that to be weeded out. It was easily weeded out and rules were put in place to help keep it out, but doing so took time, and I couldn’t run the whole spamtrap feed through the measuring stick until I reviewed it all.

Now that this is out of the way, the only things holding me back here and there are software bugs and/or server issues. Occasionally the drive on the server handling this mail fills up, so I had to do a lot of fancy coding around that, to make stuff sit and pause and wait for the disk usage to come back down. That’s no fun. But now that I’m able to work around it, I should start consistently logging data about at least five thousand spams each day.

Here’s some random statistics for you. I recently added Gmail bulk foldering to my spam results, and so far I’m seeing that Gmail is only 88.8% affective against my spam feed. Meaning, 11.2% of spam I receive is not going to the spam folder in Gmail. Of the 92,730 spam messages I’ve tracked so far, over the past forty-one days, they have come my way from 68,516 unique IP addresses, and 58,022 unique /24 blocks.

Just yesterday it dawned on me that I should start tracking domains used in spam. I decided to focus on from lines, and log unique from domains that actually exist. Just since I turned it on, I’ve tracked over 5,500 unique domains. I have a few ideas of neat things I can do with this data, after I compile enough of it, but I’m not sharing any of those secrets quite yet.

What I will share though, is information showing what IP addresses and netblocks actually send me the most spam. It’ll be interesting to see how it compares to what other people are seeing on their own mail streams. Look for that soon!

Read More… (From Al Iverson’s Spam Resource)

So, were you wondering how many average spams it takes to fill up a Gmail account?

I find today that the answer is: 280,570. Just over two hundered and eighty thousands spams is enough to make my Gmail account cry uncle. Ouch!

So, at this moment, my spamtrap is empty. I cleaned it out, making room for another 6200+ spams/day. This should get me another forty-five days or so.

It took me a bit of thinking to decide if I really wanted to delete all my spam. But, I have been logging it as of late, so I do have most of the sending IPs, subject lines, etc. logged. So, flushing away this sample doesn’t really lose me all that much.

And, there is always more spam.
Read More… (From Al Iverson’s Spam Resource)

Mark Mumma, if you weren’t aware, is the anti-spammer who sued Omega World Travel a/k/a cruise.com over spam allegations, and lost. It seems to me that this may have been a situation where hubris and anger took control, getting in the way of facts and logic.

After all, this is the guy who let his mouth get the better of him when being interviewed by Ken Magill. Page four is the, uh, I guess you’d say, the best bit, where Mumma instructs Ken Magill to return the call of Omega’s lawyer and “you guys plan your next gay weekend together.” Right after bizarrely telling Ken, “well good luck to you in prison.”

According to John Levine, Ed Falk, and others, it looks like Mumma lost big, to the tune of $2.5 million in damages, Omega having won the defamation lawsuit it brought against him. Ken Magill’s overview and analysis is spot on, in my opinion.

I can’t tell for sure whether or not the mail in question was spam. So I’ll set that aside for the moment. But clearly, calling people names, risking (and ultimately committing) defamation is unwise. Sticking to the facts would likely help prevent that. Nor is it wise to agree to talk to a reporter then flip out and start to insult both him and the other party involved. Nor is it wise to refuse the settle the defamation allegations, even after you lose your anti-spam suit, setting yourself up to lose even more. Nor is it wise to tell people you’re going to sue them if they don’t stop emailing you, without telling them your email address. Et cetera, et cetera, et cetera. I could go on for hours.

I hope somebody obtains all the court documents and uses them as the “how not to behave” section of a book on how to fight spam.

May 30, 2007 update: More on this from Ken Magill.
Anti-Spammers Distance Themselves from Mumma
Belligerant Anti-Spammer Watch: Mumma’s Claims Debunked

Read More… (From Al Iverson’s Spam Resource)

I’m at a conference, so I don’t have much time to blog about it, but helpful folks keep forwarding me this over and over, convinced that I need to be told. So, for the record, I am aware that Soloway was arrested. More on the topic from Forbes, CNet, and Yahoo. I really don’t have much to add to their excellent summaries of the situation.
Read More… (From Al Iverson’s Spam Resource)

Over on Email Insider, Melinda “Email Diva” Krueger provides some wise advice on list cleaning best practices.

Two second summary:

• Get non-responders off your list.
• Test reconfirmation/renewal re-engagement methodology

I love it. If it’s not yet considered industry standard practice, it’s about time for that to change. Removing people who haven’t clicked in years removes dead weight without killing your list. I regularly see it improve ROI, as you get the spamtraps and complainers out of the way, leaving only the people who actively want your mail and are most likely to respond. And you improve their ability to respond, by clearing out the bad addresses that cause spam filtering and blocks.

Read it, bookmark it, share it with your friends. This info should forever be ensconced in your personal “Email Marketing 101″ handbook.
Read More… (From Al Iverson’s Spam Resource)

More on why email address harvesting sucks from BtoB Magazine by way of Email Marketing Reports.
Read More… (From Al Iverson’s Spam Resource)

Jamie Schissler, Strategy Director at Avenue A | Razorfish, has this to say on the topic:

Having worked in the promotion marketing space, I love sweepstakes. They should be a staple in every brand and marketer’s toolbox, and I’ve seen them executed with tremendous success. But just as you wouldn’t use a tape measure to drive a nail, sweepstakes are not particularly effective for database growth and development. As a promotional strategy, they are great; as an acquisition strategy, less so. Let sweepstakes supplement your acquisition activities, not spearhead them.

Always good to see somebody agreeing with me on that subject. I’ve seen many senders run into many issues by using a sweepstakes as a list building approach. It’s definitely not something I personally would recommend.

Switching hats for a moment…in case you’re wondering which address(es) of mine started out legit but ended up geting the most spam? It was the address that I gave for a sweepstakes in 2003. Buried in the T&Cs was legalese that said they were allowed to sell my address, and wow, did they ever. This address now gets every kind of spam with every kind of falsity and deception. Bad subject lines. No postal address. No way to unsubscribe, etc. All traced back to this one address that I used in this one place.

As a consumer, this was a huge turnoff, that made me never want to give out an email address for a sweepstakes ever again. Yuck.
Read More… (From Al Iverson’s Spam Resource)

This has been making the rounds in the blogosphere these past few days: Vonage is taking months/years old addresses, submitted ONLY for a forward-to-a-friend promotion, and sending advertising to those people years later.

If true, it violates all best practice guidelines for appropriate email marketing.

If true, it’s questionably legal.

The worst/best part is that the emails Vonage sent claim to be new referrals, saying “Andy Sernowitz asked us to tell you…” even though Andy Sernowitz apparently hasn’t asked Vonage to do this in many, many months.

Psst, Vonage? Ever heard of Jumpstart? If not, I suspect you will be learning more about that particular FTC action soon enough.
Read More… (From Al Iverson’s Spam Resource)

OK, not spam related, but still topical. Hot on the heels of my own post on the top ten dos and don’ts of blogging comes this whiny article from Pete Blackshaw, published on ClickZ.

Pete probably should quit blogging; he sounds tired. As for the rest of us, there’s a lot of info just waiting to be shared with the world, and blogging is a good way to get it out there. I’m not tired. I love it, and want to see more people doing it.

(I promise that the non-spam posts here will be very rare. There’s nothing I hate more than off-topic posts on a specialist content blog…remember, kids, do as I say, not as I do!)
Read More… (From Al Iverson’s Spam Resource)

Anne Mitchell pointed me toward a post on her Internet Patrol blog about how Flixsters invite a friend functionality either asks you for or allows you to give Flixster your AOL, Hotmail, Yahoo and Gmail passwords.

Then Flixster logs in to your email account, finds your address book, and sends out invites to your friends in your name from your own email account.

Flixster founder Joe G (Joe Greenstein?) posted a comment in response to Anne, confirming that this was indeed the case. He goes on to state that users are then ALWAYS given the list of contacts and asked to select whom to invite.

Well, thats good. But still, yikes.

Are there still people out there ignorant enough to give out their email passwords to strangers? Joe may be trustworthy, but Joes still a stranger, and so is Flixster.

In my opinion, there should never be a reason to give an account password to some site other than that site itself. If that other site ever gets hacked, or if their data security is lax enough to allow employees to steal data, itll end up being a privacy (and spam) disaster.

This reminds me of something. Recently, SpamHuntress talked about how Myspace accounts get hacked, and it sounds similar to this. Give us your username and password so we can do something cool with your account.and then well do a bunch of other bad stuff too, without your knowledge.

I am not suggesting that Flixster are a bunch of privacy thieves. I am not implying that theyre going to do something bad with your email accounts. I am, instead, suggesting that you shouldnt give your passwords out, to prevent something like that from ever happening to you, regardless of how trustworthy the site/service actually is or claims to be.

Do you know how much it would suck if somebody hacked into your AOL or Gmail account and were able to send emails as you? It could be used to send spam to your friends and others, matched up with your saved emails to find your passwords to financial or other accounts, be used as part of a phishing scam to get bank info from other unsuspecting people.

Read More… (From Al Iverson’s Spam Resource)