Cloudmark Blog

Intelligence Briefings from the War on Spam

 

Archive for January 2010

Today’s attempt to take over your machine: Fake AIM updates

Within the last few hours, Cloudmark has seen a marked increase in messages claiming that the recipient’s AIM account is about to be closed and that, to prevent that from happening, the recipient must download and install a new update to the AIM software.

Subject lines include:

  • AIM critical update
  • Your AOL Instant Messenger will be deleted
  • AOL Instant Messenger critical update

Kaspersky identifies the downloaded file as an installer for the Zeus bot, which has been used both for spamming and for stealing personal information and was most recently in the news for having made a home within the Amazon cloud.

As always, practicing safe computing will help you. Be wary of ’security alerts’ that ask you to download files, pay attention to those URLs (www.aim.com/download is not the same as www.aim.com.download.botdomain.com), and keep your anti-virus and anti-malware programs up-to-date.

Earthquake victims need your donations…

…scammers don’t. But they really want them.

The FBI and Better Business Bureau are both warning people about scam donation sites related to the recent earthquake in Haiti. Users should be extra wary of requests for donations that come to them unsolicited, from people they do not know.

Of course, there are legitimate ways to donate. The American Red Cross is taking donations through their website. They are also accepting donations by text message – texting “HAITI” to 90999 will donate $10 to the Red Cross, billed to your cell phone. A similar donation process is being handled by Yele.org – texting “YELE” to 501501 will donate $5. When you visit a charity’s site to donate, be certain that you’re at their legitimate site – be careful of links (especially shortened links) spread through social networking sites, as they may not be taking you to the official charities’ sites.

Back to Basics

While there are many methods by which email messages can be blocked (for example, DNSbl listings can results in IP addresses being refused connections, subject lines could match previously seen spam, or URLs or email addresses in the body might trigger a receiver’s content filters), there is one main reason that filters to the top when you consider why an ISP or anti-spam company blocked or bulk-foldered a given email message:

  • end-users have complained, in volume, about your email, or other email from your IP address

It is that simple. ISPs and anti-spam filters take steps to block mail because their users tell them it’s unwanted. They are not blocking email because they don’t like you. Senders of all sizes need to be aware that ISPs are paying much more attention now to the behavior of their users and, when their customers say “we don’t want this mail”, it has real meaning. As noted, in part, in this blog post by Laura Atkins at Word to the Wise, ISPs and deliverability experts have been saying similar things for quite some time. Keeping your recipients engaged and making sure that what you’re sending is wanted and requested before you send it goes a long way to making sure it makes it into the inbox. Also – once a user tells you they don’t want your mail by unsubscribing, don’t send them more mail! It seems obvious, but it’s happened more than once, and one of the worst things that you can do to your reputation is accidentally send mail to your suppression list.

Something else to consider – the concept of “end-user complaints”, for many ISPs and anti-spam filters, also includes email messages sent to long-dead addresses or to addresses that have never existed. If an email address has been dead, and the ISP has been sending you “no such user” or “invalid recipient” bounces, for the last few months and you’re still trying to send to it, that’s going to put your acquisition and retention policies in doubt, and the reputation of the rest of your email will sink. Al Iverson with Exact Target talks a bit about that in this post. The takeaway here is that maintaining a mailing list is more than just acquiring addresses – it’s making sure with that you respond quickly and appropriately to every unsubscribe request or bounce message you receive for every mailing you send out, it’s making sure that you are proactive in determining why your recipients don’t want your mail and taking steps to make sure they do want it, and it’s nurturing your relationship with your recipients.