Spam, campaign statistics and red flag URLs

It’s not often spammers send me their campaign statistics, but on Tuesday one did.
The spam came “from” news@udemy.com, used udemy.com in the HELO and message-ids and, sure enough, was advertising udemy.com:
 

Received: from udemy.com (unknown [198.20.115.217]) by ...
From: Udemy <news@udemy.com>
Subject: The Photoshop Secret - Master Adobe Photoshop like a Pro!
Message-ID: <20160706031012.1E35F28A6B081174@udemy.com>

 
But the call to action link was a bit.ly URL. Following the clickthroughs, the bit.ly URL redirected to linksynergy.com, which in turn redirected to udemy.com. Nothing too surprising – udemy.com’s users are paying udemy for clicks, which udemy are buying from linksynergy and linksynergy are buying from our spammer. A perfectly normal, spammer-infested affiliate programme.
The spammer might be using bitly to hide the linksynergy URL (linksynergy links on web pages might well be legitimate, but in email they’re a serious red flag and an almost sure sign that the mail is spam), but I think it more likely they’re using it for bitly’s click-through reporting.
One of the nice things about bitly clickthrough reporting is that anyone can see it, just by adding a + sign to the end of it. Our spammer sent https://bitly.com/1JUHIe3, so if we go to https://bitly.com/1JUHIe3+ we can see everything about the clicks on it.
It’s had 56,622 clickthroughs since early February. The vast majority of clicks had no referers, so were likely from email. Of the few hundred that did have referers, they mostly look like webmail. So it’s pretty likely this URL has been used solely for spam.
Bitly__The_power_of_the_link_
 
This same URL has been used in four spam campaigns so far, mostly targeted to North America.
Bitly__The_power_of_the_link_
Bitly__The_power_of_the_link_
From a spam perspective one of the interesting things is that this URL has been in active use in spam for at least six months, without any of Udemy, LinkSynergy (aka Rakuten) or bit.ly taking any action against it. It’s possible that’s just because none of them knew about it, I guess.
If I’m filtering email this tells me that bitly (or clicksynergy or linkshare) URLs in email are likely to be a problem – and, hence, if I’m sending legitimate email I should avoid using any of that sort of URL in my email. Something we’ve discussed here before.
And if I’m considering running an affiliate programme this is a good example of why I either have to run a very good, well-policed affiliate programme or make a business decision that I’ll make more money from paying spammers to bring in leads than I’ll lose customers due to my poor reputation.

Related Posts

Things to read: March 9, 2016

It’s sometimes hard for me to keep up with what other people are saying and discussing about email marketing. I’ve been trying to be more active on LinkedIn, but there are just so many good marketing and delivery blogs out there I can’t keep up with all of them.
talkingforblog
Here are a couple interesting things I’ve read in the last week.
Five Steps to Stay Out of the Spam Folder. Conceptually easy, sometimes hard to pull off in practice, these recommendations mirror many things I say here and tell my clients about delivery. The audience is in charge and your recipients are the best ally you can have when it comes to getting into the inbox.
Which states are the biggest sources of spam?. California and New York top the list, but the next two states are a little surprising. Over on Spamresource, Al points out the two next states have some unique laws that may affect the data. I just remember back in the day there were a lot of spammers in Michigan, I’m surprised there’s still a significant volume from there.
CASL didn’t destroy Canadian email. Despite concerns that CASL would destroy the Canadian email marketing industry, the industry is going strong and expanding. In fact, spending on email marketing in Canada was up more than 14% in 2015 and is on track to be up another 10% this year. Additionally, according to eMarketer lists are performing better because they’re cleaner.
A brief history of email. Part of the Guardian’s tribute to Ray Tomlinson, the person who sent the first email. Ray’s work literally changed lives. I know my life would be significantly different if there wasn’t email. Can you imagine trying to be a deliverability consultant without email? 🙂

Read More

Harvesting Addresses from LinkedIn

There seems to have been an uptick in the number of folks harvesting addresses from their LinkedIn contacts and adding them to mailing lists. I’ve been seeing this in my own mailbox. I’m getting added to different lists and because I used a tagged address I know these folks are harvesting from LinkedIn.
This behavior is really rude. Just because someone accepted your contact request on LinkedIn, doesn’t mean they want to be added to any mailing lists you may have. Let’s be honest, some people have hundreds or thousands of LinkedIn contacts. They’re not going to want to get mail from all of them.
This behavior risks your ESP account. I know of ESPs who have disconnected customers for importing all their LinkedIn contacts.
Of course, there are ways to effectively use your LinkedIn contacts. The short version is think about what you’re doing and how your mail will be received. Don’t grab all your contacts, be selective about who you choose. Have too many contacts to go through manually? That’s not an excuse, in fact, it’s an even bigger argument for not becoming a spammer.
Targeting.
I’ve previously written things you must consider when sending bulk mail to people who have connected with you on social networks.

Read More

Memories of Spam in May

This morning on Facebook a friend posted a picture saying that 15 years ago was the very first anti-spam conference (Spamcon*). All we have are some blurry scans of pictures and coffee mugs.
13322193_10209611310107693_488418243076278791_n.
That 550 sign belonged to the bar where the night out was held. It got bought by K & P and lived in their garden until it rotted away a few years ago. So many folks who are still active in the space, and so many folks who’ve moved on. Names I’d forgotten, faces I haven’t.
Many of those folks are still working in email. Some on the sending side, some on the tools and vendor side, some on the ISP side, some on the consulting side.  That conference was one of the very first times people publicly gathered to talk about spam. There were other occasions, but most were invite only with hand picked representatives of specific companies.
At that first Spamcon I was freshly laid off from MAPS (now Trend Micro). I was considering what next. The thing is, I really liked the work I was doing. MAPS had me leading a team to provide abuse desk as an outsourced service. We had a very large network provider as a customer and we were handling all the mail that came into abuse@ there. It was a challenge, I was creating processes and documenting policy, trying to do more with less and managing my first team ever.
Much of what I do now, here, grew out of that position. It was clear even then there was a need for someone who could help navigate the challenges of email.
In the same thread another person posted pictures from a social night in DC during the FTC Spam Forum. More folks, some I have lost touch with and some who are still friends and colleagues.
We were so young. All of us.
This is yet another form of community that email created. Some of it was built over email, but a lot of it happened on USENET and IRC and local meetups. There were so many ways we built community using plain text and dialup. The technology has changed, and that community from a dozen years ago has changed but it’s still all the same deep down inside.
SpamconMugs
 
(* If, at any point, you see me type Spamconk instead of Spamcon please blame autocorrect. It’s being difficult and even tries to correct it when I go back and edit sentences.)

Read More