A Disturbing Trend

Over the last year or so we’ve been hearing some concerns about some of the blacklisting policies and decisions at Trend Micro / MAPS.
One common thread is that the ESP customers being listed aren’t the sort of sender who you’d expect to be a significant source of abuse. Real companies, gathering addresses from signup forms on their website. Not spammers who buy lists, or who harvest addresses, or who are generating high levels of complaints – rather legitimate senders who are, at worst, being a bit sloppy with their data management. When Trend blacklist an IP address due to a spamtrap hit from one of these customers the actions they are demanding before delisting seem out of proportion to the actual level of abuse seen – often requiring that the ESP terminate the customer or have the customer reconfirm the entire list.
“Reconfirming” means sending an opt-in challenge to every existing subscriber, and dropping any subscriber who doesn’t click on the confirmation link. It’s a very blunt tool. It will annoy the existing recipients and will usually lead to a lot of otherwise happy, engaged subscribers being removed from the mailing list. While reconfirmation can be a useful tool in cleaning up senders who have serious data integrity problems, it’s an overreaction in the case of a sender who doesn’t have any serious problems. “Proportionate punishment” issues aside, it often won’t do anything to improve the state of the email ecosystem. Rather than staying with their current ESP and doing some data hygiene work to fix their real problems, if any, they’re more likely to just move elsewhere. The ESP loses a customer, the sender keeps sending the same email.
If this were all that was going on, it would just mean that the MAPS blacklists are likely to block mail from senders who are sending mostly wanted email.
It’s worse than that, though.
The other thread is that we’re being told that Trend/MAPS are blocking IP addresses that only send confirmed, closed-loop opt-in email, due to spamtrap hits – and they’re not doing so accidentally, as they’re not removing those listings when told that those addresses only emit COI email. That’s something it’s hard to believe a serious blacklist would do, so we decided to dig down and look at what’s going on.
Trend/MAPS have registered upwards of 5,000 domains for use as spamtraps. Some of them are the sort of “fake” domain that people enter into a web form when they want a fake email address (“fakeaddressforyourlist.com”, “nonofyourbussiness.com”, “noneatall.com”). Some of them are the sort of domains that people will accidentally typo when entering an email address (“netvigattor.com”, “lettterbox.com”, “ahoo.es”). Some of them look like they were created automatically by flaky software or were taken from people obfuscating their email addresses to avoid spam (“notmenetvigator.com”, “nofuckinspamhotmail.com”, “nospamsprintnet.com”). And some are real domains that were used for real websites and email in the past, then acquired by Trend/MAPS (“networkembroidery.com”, “omeganetworking.com”, “sheratonforms.com”). And some are just inscrutable (“5b727e6575b89c827e8c9756076e9163.com” – it’s probably an MD5 hash of something, and is exactly the sort of domain you’d use when you wanted to be able to prove ownership after the fact, by knowing what it’s an MD5 hash of).
Some of these are good traps for detecting mail sent to old lists, but many of them (typos, fake addresses) are good traps for detecting mail sent to email addresses entered into web forms – in other words, for the sort of mail typically sent by opt-in mailers.
How are they listing sources of pure COI email, though? That’s simple – Trend/MAPS are taking email sent to the trap domains they own, then they’re clicking on the confirmation links in the email.
Yes. Really.
So if someone typos their email address in your signup form (“steve@netvigattor.com” instead of “steve@netvigator.com”) you’ll send a confirmation email to that address. Trend/MAPS will get that misdirected email, and may click on the confirmation link, and then you’ll “know” that it’s a legitimate, confirmed signup – because Trend/MAPS did confirm they wanted the email. Then at some later date, you’ll end up being blacklisted for sending that 100% COI email to a “MAPS spamtrap”. Then Trend/MAPS require you to reconfirm your entire list to get removed from their blacklist – despite the fact that it’s already COI email, and risking that Trend/MAPS may click on the confirmation links in that reconfirmation run, and blacklist you again based on the same “spamtrap hit” in the future.

We have been in a pretty lengthy back and forth with maps. Its just a disaster all around. We cleaned up around 200+ accounts, but they are still seeing trap hits. I finally got fed up and we just asked them outright “we cleaned up 200+ customers lists, and are still hitting traps? any chance you guys are clicking links?”. At this point they have a substantial amount of our IP space listed and are just making this painful. They haven’t had time to respond to our question, but at this point maps seems to be the new SORBS.An ESP’s take on the issue

We (Word to the Wise) aren’t an ESP – if we were then the risk of damage to our business due to publicly criticizing a blacklist would mean we wouldn’t be able to do it – so we don’t have first-hand experience of this behaviour. We have been told by six ESPs and an infrastructure company that Trend/MAPS has ongoing issues with inaccurate listings. Four of them have said that Trend/MAPS is clicking on links in email they’re sending, in some cases confirmation links. We’ve been provided data, including web access logs showing clicks on confirmation links in email sent to “trap” domains registered by Trend from anonymous Taiwanese consumer IP addresses. Many of the “trap” domains are registered by a Director of “Core Tech” at Trend Micro, at a Taiwanese address.
These email addresses were confirmed over the past several years, and have been used to justify aggressive blacklisting of ESPs since. MAPS representatives also confirmed to two ESP representatives that they did sometimes click on links in email sent to their trap addresses during investigations – and that matches data provided to us by another ESP that suggests Trend/MAPS will sometimes go through and click on many of the links in a batch of emails, possibly including any confirmation or reconfirmation links in those emails.
So, it seems that the Trend/MAPS blacklists are being run in a way that will sometimes blacklist sources of 100% COI wanted email, as well as sources of likely wanted email that’s not entirely COI. Conversely, it’s pretty easy to identify or block the trap domains they’re using (a simple google search will find thousands of them, and null-routing the five or so MXes they use would block all email to them) so any moderately smart spammer could easily avoid being listed by them. That suggests the data quality is probably poor.
It’s even worse than that, though.
Trend/MAPS don’t only run their own spamtrap domains. They also are fed data by spamtraps run by consumer ISPs, including Comcast. There’s data from the ESPs we’ve been talking to that show that senders that have been blacklisted by Trend/MAPS for “spamtrap hits” are sending email to @comcast.net addresses that had previously been confirmed by the same anonymous Taiwanese consumer IP address as was found clicking on confirmation links. So it’s likely that Trend/MAPS habit of clicking confirmation links in mail sent to “spamtraps” is poisoning ISPs independent spamtrap data, as well as their own published blacklists.
ESP representatives have been asking Trend Micro about these issues for months. On Wednesday we invited a MAPS rep to comment on the issue as we were planning on writing about it, but didn’t hear anything back beyond a request for specific examples. We declined to provide that for several reasons – it’s not our data to share, doing so would reveal which ESPs provided it to us, and it’s all been provided to Trend/MAPS by the ESPs concerned so they already have the data and are aware of the issues.
Trend/MAPS are tainting the spamtraps they use, by setting them up such that they’re likely to catch sources of mostly wanted email, including sources of 100% COI email. If they were doing that as part of a survey or research project, that would be OK, though the data would likely not be of much value. Instead, though, they’re accusing the senders of this mail of spamming, listing them on their blacklist and making unreasonable demands of the senders before they’ll remove their listing. As MAPS are also selling this data to large US consumer ISPs who use it to block email, the senders don’t have much choice but to comply with those unreasonable demands. (Update 8/9/11: A sender who was listed by MAPS in the last few days is seeing inbox delivery at the major US ISPs we believed were Trend/MAPS customers. It appears that our data on MAPS usage is out of date.) I also wonder how accurate Trend/MAPS are in how they represent their spam filtering services and blacklist data to those ISPs who use them – I doubt those ISPs are intending to buy a blacklist service that blocks wanted, COI email.

Related Posts

Changes at Gmail

As I’ve said before, I can usually tell when some ISP changes their filtering algorithm because I start getting tons and tons of calls about delivery problems at that ISP. This past month it’s been Gmail.
There have been two symptoms I’ve been hearing about. One is an increase in bulk folder delivery for mail that previously was reliably hitting the inbox. The other is a bit more interesting. I’ve heard of 3 different mailers, with good reputations and very clean lists, that are seeing 4xx delays on some of their mail. The only consistency I, and my colleagues at some ESPs, have identified is that the mail is “bursty.”
The senders affected by this do send out mail daily, but the daily mail is primarily order confirmations or receipts or other transactional mails. They send bi-weekly newsletters, though, exploding their volume from a few tens of thousands up to hundreds of thousands. This seems to trigger Gmail to defer mail. It does get delivered eventually. It’s frustrating to try and deal with because neither side is really doing anything wrong, but good senders are seeing delivery delays.
For the bulk foldering, Bronto has a good blog post talking about the changes and offering some solid suggestions for how to deal with them. I’m also hearing from some folks who are reliable that Gmail may be rolling back some of the bulk foldering changes based on feedback from their users.
So if you’re seeing changes at Gmail, it’s not just you.

Read More

Is your mail being bulk foldered?

Daisy at Signup.to posted a list of 11 things to do when mail is going to the bulk folder. Her suggestions are a good start to troubleshooting and fixing persistent bulk foldering of mail.
One thing she doesn’t mention is that while bulk foldering can sometimes be the result of poor content, more often it’s the result of unengaged recipients. Think of bulk foldering this way: the ISP has some subscribers they’re pretty sure want your mail, so they’re not going to block your mail. But they’re pretty sure a lot of subscribers don’t want your mail so they’re not going to deliver it to the inbox.
The trick to getting mail moved out of the bulk folder is to get more people engaged with your email marketing. This is tough to do if they’re not actively checking their bulk folder for mail but there are some ways I’ve helped clients get mail into the inbox.

Read More

Feedback loops

There are a lot of different perspectives on Feedback Loops (FBLs) and “this is spam” buttons across the email industry.
Some people think FBLs are the best thing since sliced bread and can’t figure out why more ISPs don’t offer them. These people use use the data to clean addresses off their lists, lower complaints and send better mail. They use the complaints as a data source to help them send mail their recipients want. Too many recipients opted out on a particular offer? Clearly there is a problem with the offer or the segmentation or something.
Other people, though, think the existence of “this is spam” buttons and FBLs is horrible.  They call people who click “this is spam” terrorists or anti-commerce-net-nazis. They want to be able to dispute every click of the button. They think that too many ISPs offer this is spam buttons and too many ESPs and network providers pay way to much attention to complaints. The argue ISPs should remove these buttons and stop paying attention to what recipients think.
Sadly, I’m not actually making up the terminology in the last paragraph. There really are who think that the problem isn’t with the mail that they’re sending but that the recipients can actually express an opinion about it and the ISPs listen to those opinions. “Terrorists” and “Nazis” are the least of the things they have called people who complain about their mail.
One of the senior engineers at Cloudmark recently posted an article talking about FBLs and “this is spam” buttons. I think it’s a useful article to read as it explains what value FBLs play in helping spam filters become more accurate.

Read More