Threat Intelligence

Deliver Email, Smarter

It's estimated that over 20% of legitimate, permission-based email is sent to the Spam folder. So after spending time and money on your campaigns, any message that doesn't land in the Inbox is wasted marketing spend. Impressionwise’s Threat and Delivery Intelligence was built for users who want to know and improve their overall email deliverability and inbox placement. This support is provided within the below areas of knowledge.

Threat and Delivery Intelligence

• Brand/ Network Resource/ Deliverability Harm
• Network Resource/ Deliverability Impact
• Impacted Delivery

ISP Delivery and Reputation Management Sender Support

Impressionwise maintains these ISP reference tables for the benefit of senders and systems administrators working to improve email delivery.

Anti-Spam Blacklist Classification and Profiling Knowledgebase

Impressionwise maintains the largest most complete knowledgebase of known anti-spam blacklists that can affect your online sending reputation and deliverability of your emails.

Understanding Email Blacklisting

Blacklisting is a term that applies to the practice of identifying spammers based on the IP’s and domains that they send email from, then compiling this information into a list that can be referenced by email servers, which then blocks email from those IP’s being delivered to the intended recipient. This is an essential part of maintaining email as an effective tool, however based on the fact that blacklists operate on a largely independent and automated basis, they often mistake good senders for bad.

There are many specific reasons a blacklist may mistake a good sender for spam, but simply put, senders do not pay enough attention to their email marketing approach. If the only focus is to send email campaigns without understanding possible undesired effects, you’re potentially unintentionally triggering red flags and causing delivery issues. When properly managed, this risk can be entirely mitigated. This guide will get you on the right track when it comes to understanding the main concepts at play, and beginning to correct any bad email sending practice you currently have.

Email blacklists explained

As you can see, there is a lot that goes in to determining your emails inbox status. Even if you do strictly follow email marketing best practices, you are at risk of being blacklisted inadvertently. Blacklists can frequently mistake legitimate senders as spammers due to their email sending habits.

Common blacklisting triggers

• Usually, legitimate senders will build their email lists over time and email volumes will increase gradually. A sudden surge in email sending volume indicates possible spammer behavior.
• Spammers are some of the world’s most active email senders. If sending very high volumes of email, the potential to be spotted on the spam monitoring radar increases as the general recipients responses increase.
• High spam complaint rates. Everyone involved in email marketing will receive the odd complaint –e.g. recipients may not recall opting in to receive your messages – however if the number of complaints are above the accepted threshold, ISPs may start routing your emails to spam folders or blocking your emails entirely.
• Poor email list hygiene can also land you on email blacklists. Sending messages to dormant or inactive email addresses that have been turned into recycled spam traps, or worse, harvested addresses that are actually pure spam traps, is detrimental to your sender reputation.
• Bad content. Certain words or phrases express spam-like content such as “free”or “Money back offer guaranteed”, as well as lots of red color in the body text, CAPS LOCK, lots of exclamation marks!!!!! etc. are all things that should be avoided.

Doing everything right and still on a blacklist?

Even though you may be following best email practices to a tee, it does happen. The good news is that you can perform email reputation management by monitoring the blacklists on the web. Your ISP should be doing this on your behalf, however, if you’re keen to check this out yourself, you can go to http://multirbl.valli.org/ – a basic tool to monitor whether you are blacklisted. Simply type in your domain or IP and this free multiple DNS Blacklist service will cross reference other blacklists by IPV4, IPV6, or domain.

If you are blacklisted, but believe you shouldn't be, or you’ve addressed the reasons that got you on to the list in the first place, you’ll need to take action to get your IP removed from the list. You can do this by applying for a “delisting” from the blacklist in question by contacting the blacklists’owner via their website.

The key is to be proactive and address these issues quickly to prove to the ISPs that you’re serious about your reputation and about remedying your delivery challenges.

Blacklist delisting guidelines

• If you are a serial offender, you will find delisting becomes increasingly difficult, if not impossible.
• Don’t attempt to argue with or get information from listing services. Rather focus on the facts and the remedies you put in place.
• Applying for delisting when you haven’t fixed the cause, e.g. receiving too many spam complaints, is a bad idea. Fix first and apply later.

Now that you know more about email blacklisting, you’ll agree that basic email reputation management is one you don’t want to neglect. Don’t assume your ESP will always monitor this for you, your ESP cannot stop ISPs from receiving negative responses from your recipients in your database.

It is up to you to maintain your brands reputation, and developing an effective marketing strategy on a foundation of email marketing best practices will prevent you getting blacklisted in the future.

ISP Information

Impressionwise maintains these ISP reference tables for the benefit of senders and systems administrators working to improve email delivery. The “Sender Support” table below offers a quick reference to various ISP postmaster pages, FBL pages and unblocking pages. The second table, “Delivery and Filtering Details”, lists known connect limits, spam filters and certification services.

Sender Support

Delivery and Filtering Details

A little more information about the specifics of delivery at various ISPs. Note that the “does not publish” for limits means that the ISP has said they have limits, but they do not publish those limits specifically. Many of these ISPs tie sending limits to reputation; IPs with poor reputations have much lower sending limits than IPs with good reputations.

Spam Traps & Honeypots

An email address that has never given permission to an email marketer to send to the address. Due to this any messages sent to this address are immediately considered unsolicited leading to its submission to one or more DNSBL site's. Honey pot addresses, which are email addresses created and spread across websites, forums etc. waiting to be scraped or harvested by spammers. Some organizations involved in fighting spam put specific email addresses on websites that do not belong to real users and are decoys setup to monitor, collect and catch spammers.

For more information on individual blacklist operators, please see our extensive blacklist knowledgebase.

Recycled Traps & Moles

Email addresses that once belonged to a user, but have since been abandoned or closed. They are then reactivated at a later date and monitored to see who is still emailing to that address. The idea behind these addresses is not only to catch spammers but also to catch email marketers sending to unengaged subscribers.

For more information on individual blacklist operators, please see our extensive blacklist knowledgebase.

Oversight Seeds

Email address that is placed on a list, often secretly, that are created and seeded in various places online. Typically, they are hidden on websites or sometimes dropped into unsubscribe forms. Typically used for general monitoring of a company's sending network resources. Specifically, removal of highly litigious and collaborative anti-spam activists.

Typo & Fake Emails

These are spam traps at domains that are very similar to common domains, yaaho.com or ynail.com. Email messages sent to this address are potentially considered unsolicited leading to its submission to one or more DNSBL site's.

Black Holes

Email domains where incoming email messages are silently discarded (or "dropped"), without informing the sender that the message did not reach its intended recipient and never viewed by a real person.

Dormant Accountss

Detection of popular webmail HAMY (Hotmail, AOL, MSN, Yahoo) and other top provider intelligence honeypots designed as an internal network defense system to detect level of engagement.

Email addresses are not permanent. When there has been no login activity for a long period of time, the recipient account is defined by the provider as “inactive” and turned into a form of unknowing collaborator with no non-delivery report (NDR) indicating “no such user” or “mailbox not found” being sent as a response. Thus any email sent during this period of time before account deactivation is assumed, in the collective, as spam and its email signature mapped and used to block any email to other active recipient accounts within the domain.

Dormant Accounts

This site intelligence gives you the leverage of avoiding sending email traffic to millions of unused and parked website domains. Since parked domains have previously not been configured for email by the owner, any recipient is by definition, invalid and being spammed as they receive email in the form of a catch-all/role account.

Threat Keys

Protect against high-risk traffic sources. Our digital forensics analytics is designed to identify complex, non-human, machine-generated email accounts that historically use a variety of tactics to generate massive amounts of non-converting impressions.

Methodology Reference

Threat key or string. System-generated email addresses that are randomly generated phrases or words, aiming to make each look different and fool automated email filters. Additional detection techniques are applied in filtering of offensive words, phrases and non-natural email addresses like 1e49cs1pb6@company.com.

Non-memorable machine language-based recipient example:

hus5i3bdgd@gmail.com
bfd7edjfj@aol.com
fgfu998k@yahoo.com
fhf08kr6@b2b.com

Complex, non-human, pattern fingerprint example:

x12345@abc.com
5x1234@abc.com
45x123@abc.com
345x12@xyz.com

Suspicious, multi-platform recipient pool example:

j0nis1funy43@gmail.com
j0nis1funy43@aol.com
j0nis1funy43@yahoo.com
j0nis1funy43@b2b.com

Our data scientists take great care in the development and testing our machine learning technology to avoid false positives while clearly identifying all varieties of non-human traffic sources.

Questions? Please feel free to reach out with any questions you may have about our cleansing process or your results, and we look forward to you experiencing the results that truly set Impressionwise apart!

Role Accounts

Role-based email addresses (e.g. admin@, help@, sales@) are email addresses that are not associated with a particular person, but rather with a company, department, position or group of recipients.

They are not generally intended for personal use, as they typically include a distribution list of recipients.

Negative Outcomes

The main issue is that it is not possible to prove that everyone who will receive emails at these addresses has given their consent to receive them. Additionally, these addresses are commonly included in many websites (like on a Contact Us page), which means they are more susceptible to being harvested off the internet. Email harvesters love to scrape role account addresses from websites. Your ESP knows this and watches your list for a high concentration of these accounts. Send to too many and your reputation will suffer.

As if that’s not enough, blacklist providers such as Spamhaus use role accounts like these as "honeypot" spam traps in an attempt to catch spammers claiming that any email sent to those addresses is spam by default because the address was obtained and used without permission.

Lastly, these unintended recipients could be “habitual protestors” or frequent spam complainers. Compounding the consequences on a well-placed compliant message, you can't prove consent for all recipients, which makes it easy to run afoul of anti-spam legislation.

Questions? Please feel free to reach out with any questions you may have about our cleansing process or your results, and we look forward to you experiencing the results that truly set Impressionwise apart!

Disposable Email Addresses

As their naming suggests, these addresses are intended to be used and discarded. Disposable email addressing (DEA) refers to an approach where a unique email address is used for every contact or entity. The benefit is that if anyone compromises the address or utilizes it in connection with email abuse, the address owner can easily cancel (or "dispose" of) it without affecting any of their other contacts.

Due to the temporal and disposable nature of these email addresses, sending to them is not advised. The following shows how many of these Disposable Email Addresses were found in your list.

Anonymous Throwaway Email Addresses

When you sign up for something on the Web with a disposable email address, you don't use your real email address but an alias of it. Every alias is created specifically for a site or mailing list, and the disposable email address becomes associated with it.

By default, all aliases of your real email address forward any mail to that real address, just as if you had used your primary email address in the first place.

But as soon as spam trickles in, the difference shows. Since every disposable email address is given only to one site and associated with it, the source of spam can be identified easily.

Temporary Email Addresses

Perhaps the most well-known example of a disposable address, temporary addresses function for a period of time before becoming inactive. The time can vary from a specified length of time up until when you restart your browser or computer. By default, all aliases of your real email address forward any mail to that real address, just as if you had used your primary email address in the first place.

Questions? Please feel free to reach out with any questions you may have about our cleansing process or your results, and we look forward to you experiencing the results that truly set Impressionwise apart!

Non-Human Invalid Traffic (Proxy/ Bot Detection)

Human or Bot? Friendly or Malicious? Protect against high-risk traffic sources (bad actors) and guard against ad-fraud in the form of Non-Human Invalid Traffic (IVT). Our sophisticated machine learning algorithms identify traffic originating from botnets, data center traffic, click farms, proxies, malicious script injectors and hijacked devices, delivering the highest quality reach to your clients while driving the strongest ROI for your in-flight campaigns.

Bot Primer

To advertisers, most bots are the nonhuman programs who generate fake ad impressions or serve hidden ads to trick browsers into downloading malware or spreading spam.

There are both legitimate and malicious bots out there. The legitimate ones keep the web running smoothly and ensure that the higher quality content gets seen, but malicious bots do the exact opposite.

Malicious bots are designed by hackers and other internet users to generate false ad impressions, serve spam and malware, overtake networks of computers to form botnets, and steal content and information. Their actions are becoming more human and advanced, making them harder to detect. One of the most costly types of malicious bots are click bots.

Click/ Ad Fraud

Click bots are the ad fraud bots that advertisers have grown to know and despise. These bots set out to intentionally engage with your advertising, therefore skewing your data incorrectly and costing you money for fraudulent clicks. Not only does this result in misinformation for marketers, but if you’re using pay-per-click (PPC) campaigns, those clicks add up to wasted dollars on fake visits that didn’t even come from humans, let alone your audience.

Anonymous Proxies

Another form of non-human invalid traffic is anonymous proxies designed to help the user hide their real IP address. It means you conceal your presence online and your actual location. No one will be able to establish a hidden connection with your PC.

IVT in anything, contaminates everything. Beyond generating waste and distrust, it undermines the integrity of every other effectiveness metric and hurts both buyers and sellers – degrading the value of the advertising industry as a whole.

Our sophisticated IVT detection is designed to protect media buyers, ad networks and sellers a trusted method to better protect their traffic and campaigns from IVT threats.

Intelligent Bot/Proxy/IVT Detection

We've built a database containing hundreds of thousands of browser and bot signature variants, anonymous proxies which allows us to accurately identify non-human, invalid traffic while allowing legitimate traffic to pass through. These threat signature have been classified into the following categories.

	Data Mining Crawler. A specific purpose-built Internet bot which systematically browses the internet in search of data exploits.
	Anonymizing Proxy/ TOR/ Click Farm. Anonymizing services create a tunnel between user and the internet. Users are hidden under the IP address of the VPN server.
	Fake Crawler/ Ghost Sites. IP addresses that do not belong to the robots of major search engines (Google, Bing, Yandex ..), but they send the useragent strings of these robots.
	Malicious Spam Bot. E-mail spambots harvest e-mail addresses from material found on the Internet in order to build mailing lists for sending unsolicited e-mail (such as Cutwail, Rustock, Lethic, Kelihos, etc.), which have been abused to send spam, worms/viruses that do their own direct mail transmission, or some types of trojan-horse or "stealth" spamware, dictionary mail harvesters etc.
	Known Attack Source. IP addresses scan HTTP/HTTPS for vulnerable installations of known web applications (phpMyAdmin, Joomla ..), Brute-Force Logins (Joomla, Wordpress ..) and run attacks on the services MAIL, SMTP, IMAP, POP3...

Constantly Updated Signatures

Redefining state-of-the art, every day. Our data analytics team collects traffic signals from across our global network to discover new bot variants and IVT traffic sources creating new threat signatures.

URI Advisories

Short for Uniform Resource Identifier Blacklist”., is a company/ website that produces a list of domain names observed sending spam or other undesired email content.

As subscribers to the URI advisory, ISPs and companies will know from which domain names appearing in the email from which to block traffic. Most traffic blocking occurs during the SMTP connection phase. The receiving end will check the URI for the connecting or sender domain name. If the domain name matches one on the list, then the connection gets dropped before accepting any traffic from that email sender.

For a complete understanding of the blacklisting process and how it can affect your email delivery as well as your sender reputation, see our Understanding Email Blacklisting help doc.

The various URI’s have different policies yet generally encompass the three major points:

• Goals. What does the URIBL seek to list? Is it a list of open-relay mail servers or open proxies – or of IP addresses known to send spam – or perhaps of IP addresses belonging to ISPs that harbor spammers?
• Nomination. How does the DNSBL discover addresses to list? Does it use nominations submitted by users? Spam-trap addresses or honeypots?
• Listing lifetime. How long does a listing last? Are they automatically expired, or only removed manually? What can the operator of a listed host do to have it delisted?

Impressionwise maintains the largest most complete knowledgebase of known anti-spam, URI or domain-based blacklists that can affect your online sending reputation and deliverability of your emails.

Highlights include detailed information for each site:

• Site name and description
• Threat-level
• Nomination process
• Listing lifetime
• Delisting guidance

Blacklist profiles

To view our knowledgebase of known anti-spam, URI or domain-based blacklist profile select from one of the following below.

For additional guidance or any questions you may have, please contact us.

RBL Advisories

Short for Realtime Blackhole List, is a company/ website that produces a list of IP addresses observed sending spam or other undesired email content.

As subscribers to the RBL, ISPs and companies will know from which IP addresses to block traffic. Most traffic blocking occurs during the SMTP connection phase. The receiving end will check the RBL for the connecting IP address. If the IP address matches one on the list, then the connection gets dropped before accepting any traffic from that email sender.

For a complete understanding of the blacklisting process and how it can affect your email delivery as well as your sender reputation, see our Understanding Email Blacklisting help doc.

The various RBL’s have different policies yet generally encompass the three major points:

• Goals. What does the RBL seek to list? Is it a list of open-relay mail servers or open proxies – or of IP addresses known to send spam – or perhaps of IP addresses belonging to ISPs that harbor spammers?
• Nomination. How does the RBL discover addresses to list? Does it use nominations submitted by users? Spam-trap addresses or honeypots?
• Listing lifetime. How long does a listing last? Are they automatically expired, or only removed manually? What can the operator of a listed host do to have it delisted?

Impressionwise maintains the largest most complete knowledgebase of known anti-spam, RBL or IP-based blacklists that can affect your online sending reputation and deliverability of your emails.

Highlights include detailed information for each site:

• Site name and description
• Threat-level
• Nomination process
• Listing lifetime
• Delisting guidance

Blacklist profiles

To view our knowledgebase of known anti-spam, RBL blacklist profile select from one of the following below.

For additional guidance or any questions you may have, please contact us.

Blacklist Removal Process

For a complete understanding of the blacklisting process and how it can affect your email delivery as well as your sender reputation, see our Understanding Email Blacklisting help doc.

Determine why you are listed

Each blacklist has their own listing criteria that may include technical listings, policy listings, and evidence based listings.

Technical listings - are those that occur mostly from mail server configuration issues such as missing or incorrect reverse DNS records, missing on incorrect banner greetings, and mail servers operating in IP address space that an ISP has specified that mail servers should not be operating in.

Policy listings - are those based on an operator that does not wish to receive email from certain countries, or ISPs, or has a history of not honoring unsubscribe requests.

Evidence based listings - are those where the operator has receive direct (or indirect) evidence that an IP address has been involved in sending unsolicited emails.

For additional guidance, Impressionwise maintains the largest most complete knowledgebase of known anti-spam, IP and domain-based blacklists that can affect your online sending reputation and deliverability of your emails.

Resolve the underlying issue(s)

Once you have determined why an IP address has been listed you can begin your internal process of resolve the issue. This is a good time to confirm that your network, mail server, and computers are properly configured. Common resolutions include: fixing forward and reverse DNS records, STMP banners, scanning all machines on the network for viruses, patching operating systems, configuring routers more securely, and enforcing strong passwords.

Follow the blacklist removal process

After you have fixed the issues you'll need to go back to the blacklist's website and follow their specific removal process.

Self-service removal - Some blacklists have a self-service removal feature. These generally allow for near immediate removal from the blacklist. Be sure that you've resolved the issue before doing this. When an IP address gets listed again after removal the process can become more difficult.

Time-based removal - Most blacklists do not offer self-service or manual removal. They have a process that runs that will automatically remove low-level listings within a week or two. If the IP address has been involved in sending spam multiple times or in high volumes this process may take longer.

Things to keep in mind when contacting a blacklist operator

Don't lie - Don't tell the operator you've resolved the problem when you haven't. If you lie that you've resolved the issue and it happens again they will likely not talk to you anymore.

Keep it polite and professional - When you are having difficulty in removing a listing let them know what you are trying to do to resolve the issue. The more professional you are with them the more they'll be willing to help you resolve the issue. They are trying to stop people from receiving spam, not trying to keep you from legitimate non-spam correspondence.

For additional guidance or any questions you may have, please contact us.