List Hygiene for Improved Inbox Placement

LIST HYGIENE FOR IMPROVED INBOX PLACEMENT

Jason Zanon, Senior Support Specialist

By the conclusion of this training, you will be able to:

• Explain why list hygiene is important• Deduplicate supporters• Ensure email addresses are valid• Define “engaged” supporters• Identify “engaged” supporters• Conduct a re-engaging campaign• Modify email sending practices based on the

results of the re-engaging campaign

Learning Objectives

EMAIL SERVICE PROVIDERS ARE UNDER NO LEGAL CONTRACT, MORAL BOND, ETHICAL OBLIGATION, RELIGIOUS COMMANDMENT, PHILOSOPHICAL FIAT, OR METAPHYSICAL CONCORDANCE TO DELIVER YOUR EMAIL.

They don’t have to make best effort. They just have to… effort… well, technically, not even that.

Pruning Time (Jennie Cell, 1955)

Q. How does spam software work?

A. It learns.

Every time your mark something spam, you’re teaching your mail server what words, phrases, and formats appear in spammy email.

First, it learns from you

Spam blockers contain hundreds of rules about spam, accumulated over 10+ years

Second, it learns from everyone else

body Generic Test for Unsolicited Bulk Email GTUBE 1000.000

full Listed in Razor2 (http://razor.sf.net/) RAZOR2_CHECK 0 0.150 0 1.511body Razor2 gives confidence level above 50% RAZOR2_CF_RANGE_51_100 0 1.485 0 0.056full Listed in DCC (http://rhyolite.com/anti-spam/dcc/)

DCC_CHECK 0 1.373 0 2.169full Listed in Pyzor (http://pyzor.sf.net/) PYZOR_CHECK

0 2.041 0 3.451body Incorporates a tracking ID number TRACKER_ID

1.825 1.064 1.818 0.555body Weird repeated double-quotation marks WEIRD_QUOTING 1.353 1.966 1.774 2.000rawbody Extra blank lines in base64 encoding

MIME_BASE64_BLANKS 0.693 0.819 1.391 1.469rawbody base64 attachment does not have a file name MIME_BASE64_NO_NAME 0.022 0 0.017 0.000rawbody Message text disguised using base64 encoding MIME_BASE64_TEXT 1.780 0.110 1.403 0.298rawbody MIME section missing boundary MIME_MISSING_BOUNDARY 0 0.247 0.224 0body Multipart message mostly text/html MIME MIME_HTML_MOSTLY 1.540 0.285 0.713 1.023body Message only has text/html MIME parts MIME_HTML_ONLY 1.204 1.158 1.156 0.177rawbody Quoted-printable line longer than 76 chars

MIME_QP_LONG_LINE 0 0.000 0.105 0.039rawbody MIME filename does not match content

MIME_SUSPECT_NAME 0.100body HTML and text parts are different MPART_ALT_DIFF 1.837 1.505 1.823 0.066body Character set indicates a foreign language CHARSET_FARAWAY 3.200body Message written in an undesired language UNWANTED_LANGUAGE_BODY 2.800body Body includes 8 consecutive 8-bit characters

BODY_8BITS 1.500body Body contains a ROT13-encoded email address

EMAIL_ROT13 2.720 1.474 2.934 3.105body Message body has 70-80% blank lines BLANK_LINES_70_80 1.668 1.127 0.745 1.515body Message body has 80-90% blank lines BLANK_LINES_80_90 0.046 0 0.216 0body Message body has 90-100% blank lines BLANK_LINES_90_100 1.490 1.750 1.877 1.996body Message body has many words used only once

UNIQUE_WORDS 3.109 2.549 1.639 2.273body Message body mentions many internet domains

DOMAIN_RATIO 2.552 1.360 2.534 3.176header Did not pass through any untrusted hosts ALL_TRUSTED -2.400 -2.820 -2.867 -3.300header NJABL: sender is confirmed open relay RCVD_IN_NJABL_RELAY 0 0.934 0 1.397header NJABL: dialup sender did non-local SMTP RCVD_IN_NJABL_DUL 0 1.655 0 0.088header NJABL: sender is confirmed spam source RCVD_IN_NJABL_SPAM 0 1.051 0 1.841header NJABL: sent through multi-stage open relay RCVD_IN_NJABL_MULTI 1header NJABL: sender is an open formmail RCVD_IN_NJABL_CGI 1header NJABL: sender is an open proxy RCVD_IN_NJABL_PROXY 0 1.026 0 0.438header SORBS: sender is open HTTP proxy server RCVD_IN_SORBS_HTTP 0 0 0 0.043header SORBS: sender is open proxy server RCVD_IN_SORBS_MISC 0 0 0 0.338header SORBS: sender is open SMTP relay RCVD_IN_SORBS_SMTP 0 1.597 0 2.493header SORBS: sender is open SOCKS proxy server

RCVD_IN_SORBS_SOCKS 0 1.847 0 2.054header SORBS: sender is a abuseable web server RCVD_IN_SORBS_WEB 0 0 0 0.007header SORBS: sender demands to never be tested

RCVD_IN_SORBS_BLOCK 1header SORBS: sender is on a hijacked network RCVD_IN_SORBS_ZOMBIE 0 0.819 0 0header SORBS: sent directly from dynamic IP address

RCVD_IN_SORBS_DUL 0 0.137 0 1.987header Received via a relay in Spamhaus SBL RCVD_IN_SBL 0 1.050 0 0.107header Received via a relay in Spamhaus XBL RCVD_IN_XBL 0 2.511 0 3.076header Envelope sender in dsn.rfc-ignorant.org DNS_FROM_RFC_DSN 1header Envelope sender in postmaster.rfc-ignorant.org

DNS_FROM_RFC_POST 0 1.376 0 1.614header Envelope sender in abuse.rfc-ignorant.org DNS_FROM_RFC_ABUSE 0 0.374 0 0header Envelope sender in whois.rfc-ignorant.org DNS_FROM_RFC_WHOIS 0 0.492 0 0.296header Envelope sender in bogusmx.rfc-ignorant.org

DNS_FROM_RFC_BOGUSMX 0 1.463 0 2.630header Received via a relay in list.dsbl.org RCVD_IN_DSBL

0 2.765 0 3.805header From: sender listed in dnsbl.ahbl.org DNS_FROM_AHBL_RHSBL 0 0.070 0 0.295header Has Habeas warrant mark and on Infringer List

HABEAS_INFRINGER 0 16.0 0 16.0header Has Habeas warrant mark and on User List HABEAS_USER 0 -8.0 0 -8.0header Sender is in Bonded Sender Program (trusted relay)

RCVD_IN_BSP_TRUSTED 0 -4.3 0 -4.3header Sender is in Bonded Sender Program (other relay)

RCVD_IN_BSP_OTHER 0 -0.1 0 -0.1header Sender domain is new and very high volume SB_NEW_BULK 1header Sender IP hosted at NSP has a volume spike

SB_NSP_VOLUME_SPIKE 1header Received via a relay in bl.spamcop.net RCVD_IN_BL_SPAMCOP_NET 0 1.832 0 1.216header Received via a relay in RSL RCVD_IN_RSL

0 0.677 0 1.720header Relay in RBL, http://www.mail-abuse.org/rbl/ RCVD_IN_MAPS_RBL 1header Relay in DUL, http://www.mail-abuse.org/dul/

RCVD_IN_MAPS_DUL 1header Relay in RSS, http://www.mail-abuse.org/rss/

RCVD_IN_MAPS_RSS 1header Relay in NML, http://www.mail-abuse.org/nml/

RCVD_IN_MAPS_NML 1header Envelope sender has no MX or A DNS records

NO_DNS_FOR_FROM 0 1.1 0 1.6header Subject contains a gappy version of 'cialis' SUBJECT_DRUG_GAP_C 1.993 1.917 2.501 1.325header Subject contains a gappy version of 'levitra' SUBJECT_DRUG_GAP_L 2.117 2.726 2.181 2.456header Subject contains a gappy version of 'phentermine'

SUBJECT_DRUG_GAP_P 0.621 0.765 0.698 1.425header Subject contains a gappy version of 'soma' SUBJECT_DRUG_GAP_S 2.005 0.277 2.920 2.041header Subject contains a gappy version of 'valium' SUBJECT_DRUG_GAP_VA 2.005 1.922 2.934 3.680header Subject contains a gappy version of 'viagra' SUBJECT_DRUG_GAP_VIA 2.659 1.770 3.158 0.253header Subject contains a gappy version of 'vicodin' SUBJECT_DRUG_GAP_VIC 2.560 2.961 2.691 2.868header Subject contains a gappy version of 'xanax' SUBJECT_DRUG_GAP_X 2.538 2.282 2.945 2.512body Talks about price per dose DRUG_DOSAGE

0.342 0.608 0.405 0.862body Mentions an E.D. drug DRUG_ED_CAPS

0.122 1.535 0 0.185body Viagra and other drugs DRUG_ED_COMBO

1.000 0.183 1.415 1.636body Talks about an E.D. drug using its chemical name

DRUG_ED_SILD 1.856 0.421 1.597 1.666body Mentions Generic Viagra DRUG_ED_GENERIC

1.933 1.181 0 1.128body Fast Viagra Delivery DRUG_ED_ONLINE

0.553 1.820 1.097 2.300body Deep discount medications DEEP_DISC_MEDS 2.480 1.211 2.573 2.626body Online Pharmacy ONLINE_PHARMACY 2.730 0 2.895 0.000body Attempts to disguise the word 'viagra' VIA_GAP_GRA 2.800 3.171 2.886 3.005body Two or more drugs crammed together into one word

DRUGS_SMEAR1 0.515 1.522 0.475 2.351header Host HELO did not match rDNS: msn.com FAKE_HELO_MSN 1.773 1.456 2.069 2.645header Host HELO did not match rDNS: mail.com FAKE_HELO_MAIL_COM 1.303 1.972 0.111 0.000header Host HELO did not match rDNS: email.com FAKE_HELO_EMAIL_COM 0 0 0 1.537header Host HELO did not match rDNS: eudoramail.com

FAKE_HELO_EUDORAMAIL 1.520 0.907 0 0header Host HELO did not match rDNS: excite.com FAKE_HELO_EXCITE 1.840 2.127 2.127 2.074header Host HELO did not match rDNS: lycos.com FAKE_HELO_LYCOS 1.410 1.645 0 0.988header Host HELO did not match rDNS: yahoo.ca FAKE_HELO_YAHOO_CA 1.166 0 0.171 1.116header Relay HELO'd with suspicious hostname (mail.com)

FAKE_HELO_MAIL_COM_DOM 1.920 2.173 2.312 2.108header Relay HELO'd using suspicious hostname (IP addr 1)

HELO_DYNAMIC_IPADDR 3.520 2.754 4.070 4.400header Relay HELO'd using suspicious hostname (DHCP)

HELO_DYNAMIC_DHCP 2.791 0.087 0.958 1.248header Relay HELO'd using suspicious hostname (HCC)

HELO_DYNAMIC_HCC 3.360 1.540 2.451 3.741header Relay HELO'd using suspicious hostname (ATTBI.com) HELO_DYNAMIC_ATTBI 3.200 3.662 2.760 3.147header Relay HELO'd using suspicious hostname (Rogers)

HELO_DYNAMIC_ROGERS 1.677 0.793 1.888 2.094header Relay HELO'd using suspicious hostname (Adelphia)

HELO_DYNAMIC_ADELPHIA 2.320 1.829 2.389 2.199header Relay HELO'd using suspicious hostname (T-Dialin)

HELO_DYNAMIC_DIALIN 2.320 0.443 2.429 1.755header Relay HELO'd using suspicious hostname (Hex IP)

HELO_DYNAMIC_HEXIP 1.826 1.320 1.453 1.522header Relay HELO'd using suspicious hostname (Split IP)

HELO_DYNAMIC_SPLIT_IP 2.869 0.887 0.992 0.775header Relay HELO'd using suspicious hostname (YahooBB)

HELO_DYNAMIC_YAHOOBB 2.800 2.776 2.572 3.000header Relay HELO'd using suspicious hostname (OptOnline) HELO_DYNAMIC_OOL 3.120 2.508 3.065 3.182header Relay HELO'd using suspicious hostname (IP addr 2)

HELO_DYNAMIC_IPADDR2 3.271 0.805 2.554 3.496header Relay HELO'd using suspicious hostname (RR 2)

HELO_DYNAMIC_RR2 2.080 1.015 1.678 2.200header Relay HELO'd using suspicious hostname (Comcast)

HELO_DYNAMIC_COMCAST 3.040 3.533 3.217 3.700header Relay HELO'd using suspicious hostname (Telia)

HELO_DYNAMIC_TELIA 0 0 1.216 1.515header Relay HELO'd using suspicious hostname (VTR)

HELO_DYNAMIC_VTR 1.916 0.805 2.013 1.960header Relay HELO'd using suspicious hostname (Chello.no)

HELO_DYNAMIC_CHELLO_NO 1.388 0.226 1.409 1.570header Relay HELO'd using suspicious hostname (Chello.nl)

HELO_DYNAMIC_CHELLO_NL 1.762 0 0.542 0.244header Relay HELO'd using suspicious hostname (Veloxzone) HELO_DYNAMIC_VELOX 1.680 1.877 1.803 2.003header Relay HELO'd using suspicious hostname (NTL)

HELO_DYNAMIC_NTL 1.340 0.187 1.445 1.732header Relay HELO'd using suspicious hostname (Home.nl)

HELO_DYNAMIC_HOME_NL 1.737 0.635 1.660 1.878header Message headers are very long HEAD_LONG

2.5header From: does not include a real name NO_REAL_NAME 0.124 0.178 0.336 0.007header From: ends in numbers FROM_ENDS_IN_NUMS

0.177 0.516 0.517 0.000header From: starts with nums FROM_STARTS_WITH_NUMS 1.218 1.492 1.441 0.300header From: contains numbers mixed in with letters

FROM_HAS_MIXED_NUMS 0.107 0.298 0.024 0.000header From: contains numbers mixed in with letters

FROM_HAS_MIXED_NUMS3 1.132 1.113 1.513 1.614header Uses an address with lots of numbers, at a big ISP

ADDR_NUMS_AT_BIGSITE 0.072 0.748 0.112 0.081header From address is "at something-offers" FROM_OFFERS 1.822 0.861 2.243 1.491header From: has no local-part before @ sign FROM_NO_USER 1.358 0.344 1.460 0.983header To: has no local-part before @ sign TO_NO_USER

0.332 0.116 1.615 0.128header To: is empty TO_EMPTY 0 0 0.164 0.097header Reply-To: is empty REPLY_TO_EMPTY

1.274 1.410 1.568 1.643header To: repeats address as real name TO_ADDRESS_EQ_REAL 0 0.470 0.131 0.026header Valid-looking To "undisclosed-recipients" UNDISC_RECIPS 0.966 1.391 1.295 1.302header Faked To "Undisclosed-Recipients" FAKED_UNDISC_RECIPS 1.287 0.565 1.431 1.602header Subject has exclamation mark and question mark

PLING_QUERY 0.201 0.857 0.906 0.368header Subject contains a unique ID SUBJ_HAS_UNIQ_ID 0.899 1.122 0.809 1.339header Subject contains lots of white space SUBJ_HAS_SPACES 2.240 0.637 1.899 1.175header Subject is all capitals SUBJ_ALL_CAPS

0.763 0.365 0.257 0.665header Spam tool Message-Id: (99x9xx99 variant) MSGID_SPAM_99X9XX99 0.500 0.864 1.576 1.442header Spam tool Message-Id: (alpha-numeric variant)

MSGID_SPAM_ALPHA_NUM 2.640 3.004 3.330 3.228header Spam tool Message-Id: (caps variant) MSGID_SPAM_CAPS 3.500 3.221 3.545 3.791header Spam tool Message-Id: (letters variant) MSGID_SPAM_LETTERS 2.960 3.151 3.052 2.709header Spam tool Message-Id: (12-zeroes variant) MSGID_SPAM_ZEROES 1.584 1.763 1.783 1.859header Message-Id has no hostname MSGID_NO_HOST 0.087 0 0.816 0.140header Message-Id is fake (in Outlook Express format)

MSGID_OUTLOOK_INVALID 2.000 2.290 2.498 2.700header Message-ID has [email protected] MSGID_YAHOO_CAPS 2.425 0.702 2.442 3.800header Message-Id for external message added locally

MSGID_FROM_MTA_ID 1.440 1.704 1.756 1.723header Message-Id was added by a hotmail.com relay

MSGID_FROM_MTA_HOTMAIL 1.600 1.858 1.987 2.144header Date header uses unusual Y2K formatting DATE_SPAMWARE_Y2K 2.958 2.888 3.384 3.911header Invalid Date: header (not RFC 2822) INVALID_DATE 0.011 0.235 0 0.236header Invalid Date: header (timezone does not exist)

INVALID_DATE_TZ_ABSURD 0 0 0.664 0.960header Invalid date in header (wrong CST timezone)

INVALID_TZ_CST 2.044 0.066 0.598 2.873header Invalid date in header (wrong EST timezone)

INVALID_TZ_EST 1.492 2.326 1.672 3.582header Invalid date in header (wrong GMT/UTC timezone)

INVALID_TZ_GMT 1.708 0.636 1.549 0.198header Date: is 3 to 6 hours before Received: date DATE_IN_PAST_03_06 0.025 0 0.127 0header Date: is 6 to 12 hours before Received: date DATE_IN_PAST_06_12 0.301 0.211 0.918 0header Date: is 12 to 24 hours before Received: date

DATE_IN_PAST_12_24 0.374 0 0.571 0.703header Date: is 24 to 48 hours before Received: date

DATE_IN_PAST_24_48 0 0.302 0.133 0.089header Date: is 48 to 96 hours before Received: date

DATE_IN_PAST_48_96 0.034 0.257 0.222 0header Date: is 96 hours or more before Received: date

DATE_IN_PAST_96_XX 0.505 1.082 0.979 1.360header Date: is 3 to 6 hours after Received: date DATE_IN_FUTURE_03_06 1.288 0.072 2.052 0.847header Date: is 6 to 12 hours after Received: date DATE_IN_FUTURE_06_12 1.040 1.202 1.153 1.300header Date: is 12 to 24 hours after Received: date DATE_IN_FUTURE_12_24 2.118 2.329 2.863 3.031header Date: is 24 to 48 hours after Received: date DATE_IN_FUTURE_24_48 2.023 2.046 2.301 2.314header Date: is 48 to 96 hours after Received: date DATE_IN_FUTURE_48_96 2.080 2.296 2.498 2.689header Date: is 96 hours or more after Received: date

DATE_IN_FUTURE_96_XX 1.393 1.428 1.930 1.962header Headers contain an unresolved template UNRESOLVED_TEMPLATE 1.324 0.618 1.369 2.866header Subject contains too many raw illegal characters

SUBJ_ILLEGAL_CHARS 2.880 2.854 3.459 2.854header From contains too many raw illegal characters

FROM_ILLEGAL_CHARS 0.861 0.046 0 0.008header Header contains too many raw illegal characters

HEAD_ILLEGAL_CHARS 0.539 2.018 0.961 2.125header Subject contains an English UCE tag ENGLISH_UCE_SUBJECT 2.080 0.336 2.127 0.110header Subject contains a Japanese UCE tag JAPANESE_UCE_SUBJECT 0 0 1.665 1.800header Subject: contains Korean unsolicited email tag

KOREAN_UCE_SUBJECT 2.400 2.703 2.469 3.081header From and To are the same, but not exactly FROM_AND_TO_SAME 0 0.198 0 0header Received: contains a forged HELO FORGED_RCVD_HELO 0 0.050 0.266 0.000header Received: HELO and IP do not match, but should

RCVD_HELO_IP_MISMATCH 2.799 0.618 1.647 2.178header Received: contains an IP address used for HELO

RCVD_NUMERIC_HELO 0.636 1.531 1.348 1.248header Received: contains illegal IP address RCVD_ILLEGAL_IP 1.335 1.370 1.588 0.944header Received by mail server with no name RCVD_BY_IP 0 0.024 0.051 0.067header Received forged, contains fake AOL relays FORGED_AOL_RCVD 0 0 1.451 0header Contains forged hostname for a DSL IP in Brazil

FORGED_TELESP_RCVD 1.595 0.669 1.468 1.532header Forged hotmail.com 'Received:' header found

FORGED_HOTMAIL_RCVD 2.614 2.132 2.150 2.536header hotmail.com 'From' address, but no 'Received:'

FORGED_HOTMAIL_RCVD2 0.787 1.079 1.415 1.177header Forged eudoramail.com 'Received:' header found

FORGED_EUDORAMAIL_RCVD 1.657 0.653 1.130 0.290header 'From' yahoo.com does not match 'Received' headers

FORGED_YAHOO_RCVD 1.668 2.174 2.095 2.700header 'From' juno.com does not match 'Received' headers

FORGED_JUNO_RCVD 1.644 1.722 2.018 0.792header Forged 'by gw05' 'Received:' header found FORGED_GW05_RCVD 0 0 1.495 1.697header Character set doesn't exist NONEXISTENT_CHARSET 0 0 1.411 1.418header A foreign language charset used in headers CHARSET_FARAWAY_HEADER 3.200header Sent with 'X-Priority' set to high X_PRIORITY_HIGH 0.125 0.093 0.077 0.000header Sent with 'X-Msmail-Priority' set to high X_MSMAIL_PRIORITY_HIGH 0 0.267 0.021 0.000header Received: says mail sent around the world (HELO)

ROUND_THE_WORLD_LOCAL 1.347 0.464 2.351 0.213header Received: says mail sent around the world (DNS)

ROUND_THE_WORLD 0 1.741 0 1.958header Missing Date: header MISSING_DATE 0 0.019 0.647 0.000header Missing To: header MISSING_HEADERS

0 0 0.087 0.119header Similar addresses in recipient list SUSPICIOUS_RECIPS 1.473 1.459 0.820 1.915header Recipient list is sorted by address SORTED_RECIPS 0.879 1.155 1.759 0.887header Subject: contains G.a.p.p.y-T.e.x.t GAPPY_SUBJECT 1.365 1.319 2.084 1.343header Message has X-Library header X_LIBRARY

2.105 1.369 1.863 2.755header Subject contains "As Seen" SUBJ_AS_SEEN

0.995 1.691 1.214 0.000header Subject starts with dollar amount SUBJ_DOLLARS

2.449 0.973 1.935 0.054header Subject contains "For Only" SUBJ_FOR_ONLY 0.646 1.100 1.726 0.044header Subject contains "FREE" in CAPS SUBJ_FREE_CAP 0.011 0 0.146 0.000header Subject starts with "Free" SUB_FREE_OFFER

0.055 0.034 0.103 0.000header Subject GUARANTEED SUBJ_GUARANTEED

1.749 1.302 0.081 0.452header Subject starts with "Hello" SUB_HELLO 1.405 1.358 0.954 0.007header Subject includes "life insurance" SUBJ_LIFE_INSURANCE 1.840 2.068 2.184 2.020header Subject contains "Your Bills" or similar SUBJ_YOUR_DEBT 1.760 2.068 2.035 1.261header Subject contains "Your Family" SUBJ_YOUR_FAMILY 1.647 0 2.033 0.011header Subject contains "Your Own" SUBJ_YOUR_OWN 0.872 1.294 1.371 0.000header Received contains a faked HELO hostname RCVD_FAKE_HELO_DOTCOM 0.899 0.034 0.969 0.424header To: address appears in Subject ADDRESS_IN_SUBJECT 1.296 1.409 1.866 1.804header Subject talks about losing pounds SUBJECT_DIET

1.355 0.723 0.059 0.266header Header has extraneous Content-type:...type= entry

EXTRA_MPART_TYPE 0 0.222 0 0header To header contains 'recipient' marker TO_RECIP_MARKER 0 0 1.370 1.539header Spam tool pattern in MIME boundary MIME_BOUND_DD_DIGITS 3.600 4.230 4.162 4.139header Spam tool pattern in MIME boundary MIME_BOUND_DIGITS_7 0 0 1.460 0.893header Spam tool pattern in MIME boundary MIME_BOUND_DIGITS_15 2.674 3.286 3.120 3.400header Spam tool pattern in MIME boundary MIME_BOUND_MANY_HEX 1.920 2.255 2.590 2.700header Spam tool pattern in MIME boundary (rfkindy)

MIME_BOUND_RKFINDY 2.080 2.347 2.590 2.671header To: has a malformed address TO_MALFORMED 0.895 2.253 0.455 2.187header From address is webmail, but starts with a number

FROM_NUM_AT_WEBMAIL 1.389 0.258 1.901 1.617header From webmail service and address ends in numbers

FROM_WEBMAIL_END_NUMS6 0.178 0.046 0.389 0.000header From Address contains FREE ADDR_FREE

0.194 0.078 1.038 1.832header Sent to a text file TO_TXT 0 0 1.362 1.580header Involves 'china.com' CHINA_HEADER

1.840 1.911 2.312 2.386header Received line contains spam-sign (lowercase smtp)

WITH_LC_SMTP 1.600 0.235 1.862 2.200header From address has no lower-case characters FROM_NO_LOWER 1.010 1.307 1.650 0.377header Subject line starts with Buy or Buying SUBJ_BUY 0.565 0.490 0.414 0.000header Subject is indicative of a Nigerian spam NIGERIAN_SUBJECT1 0 0 0.270 0header Subject is indicative of a Nigerian spam NIGERIAN_SUBJECT2 1.235 1.765 1.935 2.090header Message would have been caught by accessdb

ACCESSDB 1header Received headers forged (AM/PM) RCVD_AM_PM

1.558 0.091 1.802 1.927header Multiple Content-Type headers found HEADER_COUNT_CTYPE 1.198 1.676 1.482 1.771header Host HELO'd as a big ISP, but had no rDNS NO_RDNS_DOTCOM_HELO 0.025 0.024 0.601 0.016header X-Originating-IP doesn't look like IPv4 address

X_ORIG_IP_NOT_IPV4 0 1.006 0.081 2.582header X-Authentication-Warning header looks faked

X_AUTH_WARN_FAKED 2.094 2.599 1.654 3.105header Received header contains faked 'mr.outblaze.com'

FAKE_OUTBLAZE_RCVD 2.400 2.726 2.867 3.100header Message is from domain that never sends email

FROM_NONSENDING_DOMAIN 1.486 0.308 1.678 0.000header Subject contains common spam sign (2 numbers)

SUBJ_2_NUM_PARENS 1.472 0.276 1.672 2.102body HTML included in message HTML_MESSAGE 0.001body Message is 0% to 10% HTML HTML_00_10

0.985 0.138 1.070 1.068body Message is 10% to 20% HTML HTML_10_20






0.516 0.027 0 0body Message is 70% to 80% HTML HTML_70_80

0.151 0 0.039 0body Message is 80% to 90% HTML HTML_80_90

0.027 0 0.036 0.146body Message is 90% to 100% HTML HTML_90_100

0.346 0.189 0.043 0.022body HTML has very strong "shouting" markup HTML_SHOUTING3 0.266 0 0.012 0.019body HTML has very strong "shouting" markup HTML_SHOUTING4 0.076 0 0.052 0body HTML has very strong "shouting" markup HTML_SHOUTING5 0.026 0 0.030 0.019body HTML has very strong "shouting" markup HTML_SHOUTING6 0 0.004 0 0.000body HTML has very strong "shouting" markup HTML_SHOUTING7 0.450 0.472 0 0.646body HTML contains text after HTML close tag HTML_TEXT_AFTER_HTML 0.312 0.205 0.032 0.031body HTML contains text after BODY close tag HTML_TEXT_AFTER_BODY 0.263 0.151 0.752 0.061body HTML comment is very short HTML_COMMENT_SHORT 0.014 0.625 0 0.000body HTML message is a saved web page HTML_COMMENT_SAVED_URL 0.528 0.130 0.470 0.146body HTML conversion tool used by spam HTML_CONVERTED 0 1.204 0.402 1.605body HTML with embedded plugin object HTML_EMBEDS

0 0.084 0.108 0.207body HTML contains unsafe auto-executing code HTML_EVENT_UNSAFE 0 0 0.022 0.515body HTML font size is tiny HTML_FONT_SIZE_TINY

0 0.419 0 0.533body HTML font size is negative HTML_FONT_SIZE_NONE 0 0.455 1.119 0.033body HTML font size is large HTML_FONT_SIZE_LARGE 1.387 0.712 0.496 0.153body HTML font size is huge HTML_FONT_SIZE_HUGE 1.796 1.278 2.265 2.594body HTML tag for a big font size HTML_FONT_BIG 0 0.232 0 0.142body HTML tag for a tiny font size HTML_FONT_TINY 2.141 0.471 0.521 0.964body HTML font color is same as background HTML_FONT_INVISIBLE 0 0.065 0 0.036body HTML font color similar to background HTML_FONT_LOW_CONTRAST 1.011 0.955 1.017 0.788body HTML font face is not a word HTML_FONT_FACE_BAD 0 0 0.044 0.037body HTML font face has excess capital characters

HTML_FONT_FACE_CAPS 0 0.804 0.281 0.247body HTML includes a form which sends mail HTML_FORMACTION_MAILTO 1.840 2.162 1.907 2.353body HTML: images with 0-400 bytes of words HTML_IMAGE_ONLY_04 3.120 3.094 3.482 3.304body HTML: images with 400-800 bytes of words HTML_IMAGE_ONLY_08 2.881 1.970 2.730 3.036body HTML: images with 800-1200 bytes of words

HTML_IMAGE_ONLY_12 2.360 1.473 2.741 2.942body HTML: images with 1200-1600 bytes of words



HTML_IMAGE_ONLY_24 1.088 1.003 0.787 0.502body HTML has a low ratio of text to image area HTML_IMAGE_RATIO_02 1.729 0 1.125 0.018body HTML has a low ratio of text to image area HTML_IMAGE_RATIO_04 1.038 0.184 0.515 0.105body HTML has a low ratio of text to image area HTML_IMAGE_RATIO_06 0.072 0 0.342 0.131body HTML has a low ratio of text to image area HTML_IMAGE_RATIO_08 0 0.000 0 0.032body HTML link text says "push here" or similar HTML_LINK_PUSH_HERE 1.627 0.409 1.843 0.873body Message is 5% to 10% HTML obfuscation HTML_OBFUSCATE_05_10 0.428 0.483 0.563 0.257body Message is 10% to 20% HTML obfuscation HTML_OBFUSCATE_10_20 0.931 0.732 0.796 0.865body Message is 20% to 30% HTML obfuscation HTML_OBFUSCATE_20_30 0.997 0.597 0.014 0.000body Message is 30% to 40% HTML obfuscation HTML_OBFUSCATE_30_40 2.517 1.933 3.005 3.445body Message is 40% to 50% HTML obfuscation HTML_OBFUSCATE_40_50 2.641 1.746 2.739 3.089body Message is 50% to 60% HTML obfuscation HTML_OBFUSCATE_50_60 2.635 1.339 2.882 3.325body Message is 60% to 70% HTML obfuscation HTML_OBFUSCATE_60_70 2.257 0.971 2.432 2.805body Message is 70% to 80% HTML obfuscation HTML_OBFUSCATE_70_80 2.308 1.334 2.256 2.689body Message is 80% to 90% HTML obfuscation HTML_OBFUSCATE_80_90 1.600 0.489 1.656 1.939body Message is 90% to 100% HTML obfuscation HTML_OBFUSCATE_90_100 1.405 0.203 1.657 1.775body HTML tags used to obfuscate words HTML_BACKHAIR_2 0.144 0 0.032 0body HTML tags used to obfuscate words HTML_BACKHAIR_4 0 0 0.138 0.058body HTML tags used to obfuscate words HTML_BACKHAIR_8 1.075 0.569 1.137 0.727body HTML has many bad attributes in tags HTML_ATTR_BAD 0 0.101 0.609 2.354body HTML appears to have random attributes in tags

HTML_ATTR_UNIQUE 0.441 1.165 1.097 0.000body Image tag intended to identify you HTML_WEB_BUGS 0.166 0.013 0.311 0.035body HTML has unbalanced "body" tags HTML_TAG_BALANCE_BODY 0.043 0.389 0.096 0.000body HTML has unbalanced "head" tags HTML_TAG_BALANCE_HEAD 0.061 0.860 0.033 0.000body HTML has "marquee" tag HTML_TAG_EXIST_MARQUEE 2.160 1.758 1.840 2.034body HTML has "tbody" tag HTML_TAG_EXIST_TBODY 1.014 0.233 0.079 0.114body HTML message is 0% to 10% bad tags HTML_BADTAG_00_10 0 0 0.001 0.000body HTML message is 10% to 20% bad tags HTML_BADTAG_10_20 0.236 0 0 0body HTML message is 20% to 30% bad tags HTML_BADTAG_20_30 0 0.169 0.035 0body HTML message is 30% to 40% bad tags HTML_BADTAG_30_40 0 0.103 0.017 0body HTML message is 40% to 50% bad tags HTML_BADTAG_40_50 0.002 0 0.000 0.010body HTML message is 50% to 60% bad tags HTML_BADTAG_50_60 0.864 0.430 1.035 0.153body HTML message is 60% to 70% bad tags HTML_BADTAG_60_70 1.726 1.127 2.314 1.356body HTML message is 70% to 80% bad tags HTML_BADTAG_70_80 1.657 0.075 2.087 2.280body HTML message is 80% to 90% bad tags HTML_BADTAG_80_90 1.861 1.309 1.831 1.911body HTML message is 90% to 100% bad tags HTML_BADTAG_90_100 0.746 1.192 2.688 2.804body 0% to 10% of HTML elements are non-standard

HTML_NONELEMENT_00_10 0 0 0.001 0.001body 10% to 20% of HTML elements are non-standard

HTML_NONELEMENT_10_20 0.045 0 0.000 0.000body 20% to 30% of HTML elements are non-standard

HTML_NONELEMENT_20_30 0.346 0.070 0 0body 30% to 40% of HTML elements are non-standard

HTML_NONELEMENT_30_40 0 0.012 0.010 0.000body 40% to 50% of HTML elements are non-standard

HTML_NONELEMENT_40_50 0.000body 50% to 60% of HTML elements are non-standard

HTML_NONELEMENT_50_60 1body 60% to 70% of HTML elements are non-standard

HTML_NONELEMENT_60_70 0.237 1.138 0.083 0.001body 70% to 80% of HTML elements are non-standard



HTML_NONELEMENT_90_100 0.011 1.582 0 2.963body HTML is extremely short HTML_SHORT_LENGTH

0.601 0.713 0.068 0.389body HTML title contains no text HTML_TITLE_EMPTY 0.022 0.045 0.036 0.004body HTML title contains "Untitled" HTML_TITLE_UNTITLED 0.222 0.259 0.792 0.000rawbody Javascript to hide URLs in browser HIDE_WIN_STATUS 0.032 0 0 0.063rawbody HTML contains needlessly encoded characters ENTITY_DEC_ALPHANUM 0.012 0 2.686 2.716body List removal information MULTI_REMOVAL_1WORD 1.005 0 0.916 0.802body Send real mail to be unsubscribed REMOVE_POSTAL 1.520 1.362 1.757 1.900body Asks you to click below (in capital letters) CLICK_BELOW_CAPS 0.135 0 0 0.112body Click to be removed CLICK_TO_REMOVE_1

0.050 0 0.192 0.791body Claims compliance with spam regulations SENT_IN_COMPLIANCE 1.520 1.786 1.850 2.000body Possible mention of bill 1618 (anti-spam bill) BILL_1618 0.994 1.692 1.798 1.895body Doesn't ask any questions NO_QS_ASKED 0 1.196 0 0.000body Offers a full refund FULL_REFUND 0.853 1.114 0.079 1.272body No such thing as a free lunch (2) COMPLETELY_FREE 0.086 0 0.840 0.026body No such thing as a free lunch (3) NO_COST

0.078 0 0.335 0.000body One hundred percent guaranteed GUARANTEED_100_PERCENT 0.615 0.435 0.669 0.000body Dear Friend? That's not very dear! DEAR_FRIEND

0.542 0.766 1.288 0.070body Contains 'Dear (something)' DEAR_SOMETHING 1.059 0.803 1.577 1.578body Talks about lots of money BILLION_DOLLARS

0.193 1.185 0.407 0.134body Talks about opting out (lowercase version) OPTING_OUT 0.157 0.494 0.030 0.479body Talks about opting out (capitalized version) OPTING_OUT_CAPS 0.067 0.026 0.483 0.000body Get a million email addresses MILLION_EMAIL

0.093 0.417 0.937 0.000body Gives a lame excuse about why spam was sent

EXCUSE_1 0 0 0.074 0.132body Claims you can be removed from the list EXCUSE_3 0 0.098 0.015 0.116body Claims you can be removed from the list EXCUSE_4 1.145 1.775 1.443 1.119body Claims you can be removed from the list EXCUSE_6 1.444 0.734 1.782 1.696body Claims you can be removed from the list EXCUSE_7 0 0.152 0.010 0.018body "if you do not wish to receive any more" EXCUSE_10 0.071 0.380 0.039 0.024body Nobody's perfect EXCUSE_12 0.153 0 0.354 0.197body Claims you opted-in or registered EXCUSE_19

0.056 0.357 0.021 0.000body Claims you have provided permission EXCUSE_23 1.840 2.088 2.312 2.400body Claims you wanted this ad EXCUSE_24 1.440 1.272 1.874 2.080body Talks about how to be removed from mailings

EXCUSE_REMOVE 0.043 0 0.513 0.310body Targeted Traffic / Email Addresses TARGETED

0 0.692 1.471 0.480body Tells you about a strong buy STRONG_BUY

2.880 3.384 3.018 3.117body Claims to honor removal requests WE_HONOR_ALL 2.063 2.365 1.789 2.029body Offers a picked stock STOCK_PICK 0.106 0.150 0.041 1.470body Offers a alert about a stock STOCK_ALERT

2.362 1.782 2.378 2.385body SEC-mandated penny-stock warning MICRO_CAP_WARNING 1.440 0.760 1.803 1.828body Not registered investment advisor NOT_ADVISOR

2.160 2.444 2.590 2.700body Describes some sort of breakthrough SOME_BREAKTHROUGH 0.232 1.921 0.907 1.610body They have selected you for something SELECTED_YOU 1.485 1.865 1.841 1.897body Contains mail-in order form MAIL_IN_ORDER_FORM 1.440 0.351 0 0body University Diplomas UNIVERSITY_DIPLOMAS

2.242 0.523 0 0body 'Prestigious Non-Accredited Universities' PREST_NON_ACCREDITED 1.520 1.394 1.607 1.901body Claims "cannot be considered spam" CANNOT_BE_SPAM 0 0 1.546 1.769body Information on growing body parts BODY_ENHANCEMENT 0.151 0.481 0.070 0body Information on getting larger body parts BODY_ENHANCEMENT2 0.814 0.845 0.109 0body Impotence cure IMPOTENCE 0.095 0.751 0 0.094body Information on how to work at home (1) WORK_AT_HOME 0 0 0.325 0.030body Information on mortgages MORTGAGE_BEST

0.948 0.923 0 0.144body Looks like mortgage pitch MORTGAGE_PITCH

0.297 0 0.065 0body Information on mortgage rates MORTGAGE_RATES 0 0.689 0.174 0.202body Order a report from someone ORDER_REPORT 0 0 1.230 0rawbody mailto URI includes removal text MAILTO_SUBJ_REMOVE 1.023 0 2.064 0.542body Includes a link for AOL users to click AOL_USERS_LINK 0 0 0.034 0.109body Talks about a million North American dollars NA_DOLLARS 2.078 2.193 2.485 2.611body Mentions millions of (dollar) ((dollar) NN,NNN,NNN.NN) US_DOLLARS_3 0.331 0.411 0.010 0.354body Talks about millions of dollars MILLION_USD

1.594 1.290 1.535 2.796rawbody Frontpage used to create the message

FRONTPAGE 0.510 0.529 0.595 2.080body Contains "My wife, Jody" testimonial JODY

0 0 1.326 0body Doing something with my income YOUR_INCOME

0.674 0.892 0.372 1.092body Resistance to this spam is futile RESISTANCE_IS_FUTILE 1.520 1.786 1.850 0body Contains 'subject to credit approval' SUBJ_2_CREDIT

0 0.500 0 0.076body Contains urgent matter URG_BIZ 0.288 0.030 1.064 1.808body Contains 'earn (dollar) something per week' EARN_PER_WEEK 1.360 0.856 1.757 1.896body Spam is 100% natural?! ALL_NATURAL 2.640 1.828 2.246 1.061body Money back guarantee MONEY_BACK 2.051 0.037 0.217 0.095body There is no catch NO_CATCH 0 0 0.127 0body There is no obligation NO_OBLIGATION

0.905 0.565 1.157 0.830body You won't be "disappointed" NO_DISAPPOINTMENT 0 1.498 1.609 0.410body Serious Enquiries Only SERIOUS_ONLY 0 0 1.664 1.748body Risk free. Suuurreeee.... RISK_FREE 0.036 0.247 0.135 0.230body As seen on national TV! AS_SEEN_ON 0.393 0.320 0.613 0.020body Common pyramid scheme phrase (1) COPY_ACCURATELY 0 0 1.324 0body Off Shore Scams OFFSHORE_SCAM 0 0.337 0.127 0.144body Why Pay More? WHY_PAY_MORE 1.249 0 1.713 1.978body Congratulations - you've been scammed? CONGRATULATIONS 0 0 0.486 0.272body Talks about free mobile phones CELL_PHONE_FREE 1.280 1.476 1.571 0.922body Talks about cell-phone signal improvement CELL_PHONE_IMPROVE 0.771 0.812 1.655 1.031body Receive a special offer RECEIVE_OFFER

1.125 0.955 1.446 0.793body Free express or no-obligation quote FREE_QUOTE_INSTANT 0.211 1.736 0.051 0.001body Free Membership FREE_MEMBERSHIP

0.492 1.182 1.587 0.873body Credit Card Offers CREDIT_CARD 0.030 0.896 0.032 0.310body Without a credit check NO_CREDIT_CHECK

0 0 1.990 0.037body Avoiding bankruptcy BANKRUPTCY 0.249 1.088 1.112 0.489body Accepting credit cards ACCEPT_CREDIT_CARDS 0.360 0 1.332 0.399body Eliminate Bad Credit BAD_CREDIT 1.161 0.252 0.817 0body Non-secured Credit/Debt NONSECURED_CREDIT

0 0 1.074 0body Consolidate debt, credit, or bills CONSOLIDATE_DEBT 0.886 0.653 0 0.245body Home refinancing REFINANCE_YOUR_HOME 1.321 0.394 0.917 0.340body Home refinancing REFINANCE_NOW

1.611 0 1.191 0.029body No Purchase Necessary NO_PURCHASE 0 0 0.107 0body No Medical Exams NO_MEDICAL 1.440 1.656 1.665 0body No Claim Forms NO_FORMS 1.622 0.973 0.912 0.011body Requires Initial Investment INITIAL_INVEST

0.433 0.450 1.026 1.230body Buy Direct BUY_DIRECT 1.502 1.779 1.757 1.663body Do it Today DO_IT_TODAY 0.036 0.047 0 0body What are you waiting for WHY_WAIT 2.240 2.060 0.796 0.764body You can search for anyone YOU_CAN_SEARCH 1.370 0.444 1.246 1.630body Score with babes! SEDUCTION 1.560 1.356 1.415 1.054body Invaluable marketing information INVALUABLE_MARKETING 0 0 1.201 0body Guaranteed Stuff GUARANTEED_STUFF 0.100 0.238 0.403 0.000body Potential Earnings EARNINGS 0 0 1.642 1.675body The best Rates THE_BEST_RATE 0 0.550 0 0.000body Amazing Stuff AMAZING_STUFF 0.949 1.269 0.069 0.102body Lose Weight Spam DIET_1 0.671 0.365 0.274 0body Describes weight loss DIET_2 0.545 0 1.034 0.316body Describes body fat loss DIET_3 1.794 1.061 1.835 2.073body Reverses Aging REVERSE_AGING 1.919 1.403 2.057 2.150body Cures Baldness HAIR_LOSS 1.381 2.371 1.428 1.738body Removes Wrinkles WRINKLES 1.730 2.097 1.917 2.091body While you Sleep WHILE_YOU_SLEEP 0.858 0.605 1.786 0.000body If only it were that easy RICH 0 0.451 0 0.000body Who really wins? YOU_WON 0.144 0.269 0 0.579body Talks about Hidden Charges HIDDEN_CHARGES 0.046 0.961 0 0.000body Freedom of a financial nature FIN_FREE

1.365 0.015 1.865 0.788body Stock Disclaimer Statement FORWARD_LOOKING 1.840 2.162 2.120 2.200body Mail guarantees satisfaction SATIS_GUAR

0.884 0 0.825 0.081body Offers Extra Cash EXTRA_CASH 0.117 0.987 0.629 0.447body Get Paid GET_PAID 1.390 1.764 1.466 0.862body Have you been turned down? BEEN_TURNED_DOWN 1.336 1.266 1.682 1.890body One Time Rip Off ONE_TIME 0.044 0 0.036 0.619body Compete for your business COMPETE

1.600 1.791 1.804 2.050body Meet Singles MEET_SINGLES 1.600 0 1.076 1.172body Join Millions of Americans JOIN_MILLIONS 0.036 0.640 0.999 0.448body Be your own boss BE_BOSS 1.512 0.145 1.847 1.648body Multi Level Marketing mentioned ML_MARKETING

0.049 0 0.103 0body Claims to be Legal ITS_LEGAL 0.186 1.109 0.432 0.264body Confidentiality on all orders CONFIDENTIAL_ORDER 1.920 1.196 1.889 1.266body Save big money SAVE_THOUSANDS 0.929 1.889 0.717 0.031body Claims you registered with a partner MARKETING_PARTNERS 2.025 0.718 2.405 1.401body Free Preview FREE_PREVIEW 1.612 0.376 1.887 1.851body Domain name containing a "4u" variant DOMAIN_4U2 1.508 1.783 1.935 1.588body Contains 'free access' with capitals FREE_ACCESS

0 0 0.253 0body Contains 'free sample' with capitals FREE_SAMPLE

0.089 0.168 0.223 0.941body Lowest Price LOW_PRICE 0.885 0 0.206 0body People just leave money laying around UNCLAIMED_MONEY 1.263 1.703 1.945 1.584body Message seems to contain rot13ed address OBSCURED_EMAIL 2.720 3.194 3.186 3.132body Mentions their affiliate partners OUR_AFFILIATE_PARTNERS 0 0 0.041 1.443body Talks about exercise with an exclamation! BANG_EXERCISE 1.450 1.993 1.662 1.442body Talks about more with an exclamation! BANG_MORE 0.287 0 0.294 0body Talks about Oprah with an exclamation! BANG_OPRAH 0.666 0.212 1.717 1.975body Talks about quotes with an exclamation! BANG_QUOTE 1.680 1.880 1.942 1.964body Talks about 'acting now' with capitals ACT_NOW_CAPS 0.222 0 0.426 0.093body Talks about 'starting now' with capitals START_NOW_CAPS 1.280 1.499 1.124 0.857body Talks about a bigger drive for sex MORE_SEX

2.240 1.762 2.287 2.422body Something is emphatically guaranteed BANG_GUAR 0.297 0 0.254 0body See for yourself SEE_FOR_YOURSELF 0.544 0.381 0.591 0.044body Possible porn - Free Porn FREE_PORN 0.794 0.023 1.937 0.000body Possible porn - Cum Shot CUM_SHOT 0.355 1.732 0.943 0body Possible porn - Pay Site PAY_SITE 0 0 1.850 1.900body Possible porn - Live Porn LIVE_PORN 0.040 0.360 0.019 0.000body Possible porn - Hardcore Porn HARDCORE_PORN 1.520 0.665 1.850 0.684body Possible porn - Hot, Nasty, Wild, Young HOT_NASTY 0.765 0.586 0.967 0.088body Possible porn - Best, Largest, Most Porn BEST_PORN 0.566 0.263 0.044 0body Possible porn - Nasty Girls NASTY_GIRLS

0.350 0.439 0.022 2.196body Possible porn - Amateur Porn AMATEUR_PORN 1.397 0.769 1.615 1.744body Possible porn - Celebrity Porn PORN_CELEBRITY 0.675 1.569 0.319 0.038body Possible porn - Adult Web Sites SOMETHING_FOR_ADULTS 1.433 1.513 1.614 0.006body Possible porn - various types of feline PORN_15 1.680 1.974 2.035 2.168body Possible porn - nasty, dirty, little etc. PORN_16 0.907 0.462 1.305 0.017body Thousands or millions of pictures, movies, etc.

LOTS_OF_STUFF 0.839 0.029 0 0.000body Attempts to disguise porn words DISGUISE_PORN 1.490 1.835 0.798 0.030uri URL uses words/phrases which indicate porn (sex)

PORN_URL_SEX 1.865 1.427 1.817 0.011uri URL uses words/phrases which indicate porn (slut)

PORN_URL_SLUT 0.941 1.022 0.194 0.094uri URL uses words/phrases which indicate porn (misc)

PORN_URL_MISC 1.728 0.573 1.767 1.620header Subject indicates sexually-explicit content SUBJECT_SEXUAL 2.160 2.538 2.775 2.900header Bulk email fingerprint (eGroups) found RATWARE_EGROUPS 2.180 2.701 2.552 2.805header Bulk email fingerprint (hash 2) found RATWARE_HASH_2 0.039 0 0.085 0.037header Bulk email fingerprint (hash 2 v2) found RATWARE_HASH_2_V2 1.798 1.319 1.767 0.980header Bulk email fingerprint (jpfree) found RATWARE_JPFREE 0 0 1.942 2.100uri Bulk email fingerprint (StormPost) found RATWARE_STORM_URI 1.920 1.518 2.405 2.295header X-Mailer has malformed Outlook Express version

RATWARE_OE_MALFORMED 2.160 2.407 2.522 2.588header Bulk email fingerprint ('esmtp' Received) found

RATWARE_RCVD_LC_ESMTP 1.745 1.474 2.122 2.083header Bulk email fingerprint (Mozilla malformed) found

RATWARE_MOZ_MALFORMED 1.594 0.990 1.752 0.558rawbody Contains a hashbuster in Send-Safe format

RATWARE_HASH_DASH 1.133 0.947 1.500 1.646header Bulk email fingerprint (netIP) found RATWARE_NETIP 0.439 1.033 2.312 2.286header Bulk email fingerprint (Gecko faked) found RATWARE_GECKO_BUILD 0 0.826 0.784 1.385header Headers are in order found in spam (MTSRIX)

HDR_ORDER_MTSRIX 0.417 0.391 0.192 1.057header Headers are in order found in spam (TRIMRS)

HDR_ORDER_TRIMRS 2.320 2.674 2.220 2.199header Bulk email fingerprint (bonus space) found RCVD_BONUS_SPC_DATE 1.371 0.904 1.575 1.872header Bulk email fingerprint (X-Message-Info) found

X_MESSAGE_INFO 3.600 4.187 4.162 4.244header Bulk email fingerprint (Received PF) found RATWARE_RCVD_PF 2.880 3.384 3.608 3.867header Bulk email fingerprint (Received @) found RATWARE_RCVD_AT 2.550 1.011 2.691 3.415uri Uses a numeric IP address in URL NUMERIC_HTTP_ADDR 1.565 1.572 1.872 2.135uri Uses a dotted-decimal IP address in URL NORMAL_HTTP_TO_IP 0.104 0.080 0.830 0.028uri Uses %-escapes inside a URL's hostname HTTP_ESCAPED_HOST 0.034 0.094 0 0.477uri Uses control sequences inside a URL hostname

HTTP_CTRL_CHARS_HOST 1.440 1.670 1.757 1.900uri Completely unnecessary %-escapes inside a URL

HTTP_EXCESSIVE_ESCAPES 0 0.645 0 0.151uri Dotted-decimal IP address followed by CGI IP_LINK_PLUS 0.211 0.024 0.192 0.232uri URL of page called "remove" REMOVE_PAGE

0.081 0.604 0 0.191uri Includes a link to a likely spammer email MAILTO_TO_SPAM_ADDR 0 0 0.106 0uri Includes a 'remove' email address MAILTO_TO_REMOVE 0.886 0 0.065 0.116uri Uses non-standard port number for HTTP WEIRD_PORT 0 0.507 0.228 0.109uri URL contains username and (optional) password

USERPASS 0.429 0.561 1.319 0.268uri Filename is just a '\#'; probably a JS trick URI_IS_POUND 0 0.333 0 0uri Includes a link to a likely spammer domain BARGAIN_URL 1.503 1.520 1.686 1.833uri Contains an URL in the BIZ top-level domain BIZ_TLD 2.167 0.527 2.434 2.288uri Contains an URL in the INFO top-level domain

INFO_TLD 1.717 0.481 1.686 0.000uri Has Yahoo Redirect URI YAHOO_RD_REDIR

1.237 1.083 1.366 1.642uri Has Yahoo Redirect URI YAHOO_DRS_REDIR

1.911 0.911 1.956 0.984uri Message has link to company offers URI_OFFERS 1.328 0.252 1.460 0.770uri Message has URI 4you URI_4YOU 1.027 1.812 0.898 1.966uri Contains URI to a document hosted at 'terra.es'

TERRA_ES 1.367 0.816 1.746 2.612uri Contains an URL-encoded hostname (HTTP77)

HTTP_77 1.514 0.605 1.812 1.981uri Contains a URI with an affiliate ID code URI_AFFILIATE 2.243 0 1.808 2.052header Message has HTTP redirector URI URI_REDIRECTOR 0 0 0.031 0.011body Bayesian spam probability is 0 to 1% BAYES_00 0 0 -1.665 -2.599body Bayesian spam probability is 1 to 5% BAYES_05 0 0 -0.925 -0.413body Bayesian spam probability is 5 to 20% BAYES_20 0 0 -0.730 -1.951body Bayesian spam probability is 20 to 40% BAYES_40 0 0 -0.276 -1.096body Bayesian spam probability is 40 to 60% BAYES_50 0 0 1.567 0.001body Bayesian spam probability is 60 to 80% BAYES_60 0 0 3.515 1.0body Bayesian spam probability is 80 to 95% BAYES_80 0 0 3.608 2.0body Bayesian spam probability is 95 to 99% BAYES_95 0 0 3.514 3.0body Bayesian spam probability is 99 to 100% BAYES_99 0 0 4.070 3.5body es Claims you can be removed in Spanish REMOVE_ES_01 1body es Claims you can be removed in Spanish REMOVE_ES_02 1body es Claims you can be removed in Spanish REMOVE_ES_03 1body es Claims you can be removed in Spanish REMOVE_ES_04 1body es If you send an email you will be OptOut REMOVE_ES_05 1body es Claims you can opt-out REMOVE_ES_06

1body es Claims you can opt-out REMOVE_ES_07

1body es Claims you can opt-out REMOVE_ES_08

1body es If you want to subscribe... SUBSCRIBE_ES_01

1body es Claims not to be spam in Spanish EXCUSE_ES_01

1body es Someone fell free to send you a message in Spanish

EXCUSE_ES_02 1body es Someone requested an spammer to spam you in Spanish EXCUSE_ES_03 1body es El correo como alternativa comercial EXCUSE_ES_05 1body es Mensaje enviado por error EXCUSE_ES_06 1body es No se puede considerar spam EXCUSE_ES_07

1body es Para dejar de fumar DEJAR_DE_FUMAR_ES

1body es NOS CHILLAN PARA DECIR QUE ES GRATIS

GRATIS_ES 1.4body es Nos animan a contestar si estamos interesados

INTERESADO_ES 1body es Dice cumplir con la ley LEY_ORGANICA_ES

2.0body es Clama cumplir con la normativa SPAM NORMATIVA_SPAM_ES 2.0body es No existe legislación en Chile contra el SPAM

LEY_CHILE_ES_01 1body es Clama cumplir con la legislación chilena LEY_CHILE_ES_02 1body es Inmigración legal (?) a los Estados Unidos TARJETA_VERDE_ES 1body es Promocion especial. PROMOCION_ES

1body es Alta en buscadores hispanos. ALTA_BUSCADORES_ES 1body es IMPERATIVOS/EXCLAMACIONES EN MAYUSCULAS. EXCLAMACION_ES 1body es Presentación de un nuevo producto. PRESENTAMOS_ES 1body es Pago contra reembolso. CONTRA_REEMBOLSO_ES 1body es Para hacer su pedido. PEDIDO_ES 1body es Haga click aqui. CLICK_ES 1body es Los regalos no existen, salvo de nuestros amigos.

REGALO_ES 1body es Pueden ser ganadores. GANADORES_ES_01

1body es Ha sido ganador. GANADORES_ES_02 1body es Porno gratis. PORNO_GRATIS_ES 1body es Mas informacion. MAS_INFORMACION_ES

1body es Informacion y reserva INFORMACION_RESERVA_ES 1body es Conviertete en Spammer. REENVIA_ES 1body es No nos envían más spam... seguro que no. NO_MAS_MAIL_1_ES 1body es No recibirá este spam otra vez... seguro que no.

NO_MAS_MAIL_2_ES 1body es Las direcciones fueron obtenidas de internet.

COLECTOR_DE_MAILS_ES 1header Contains valid Hashcash token (20 bits) HASHCASH_20 -0.500header Contains valid Hashcash token (21 bits) HASHCASH_21 -0.700header Contains valid Hashcash token (22 bits) HASHCASH_22 -1.000header Contains valid Hashcash token (23 bits) HASHCASH_23 -2.000header Contains valid Hashcash token (24 bits) HASHCASH_24 -3.000header Contains valid Hashcash token (25 bits) HASHCASH_25 -4.000header Contains valid Hashcash token (>25 bits) HASHCASH_HIGH -5.000header Hashcash token already spent in another mail

HASHCASH_2SPEND 0.100header SPF: sender matches SPF record SPF_PASS

-0.001header SPF: sender does not match SPF record (fail)

SPF_FAIL 0 0.001 0 0.875header SPF: sender does not match SPF record (softfail)

SPF_SOFTFAIL 0.500 0.842 0.500 0.500header SPF: HELO matches SPF record SPF_HELO_PASS -0.001header SPF: HELO does not match SPF record (fail)

SPF_HELO_FAIL 0 0.405 0 0.001header SPF: HELO does not match SPF record (softfail)

SPF_HELO_SOFTFAIL 0 1.002 0 3.140body Contains an URL listed in the SBL blocklist URIBL_SBL 0 0.629 0 0.996body Contains an URL listed in the SC SURBL blocklist

URIBL_SC_SURBL 0 3.897 0 4.263body Contains an URL listed in the WS SURBL blocklist

URIBL_WS_SURBL 0 0.539 0 1.462body Contains an URL listed in the PH SURBL blocklist

URIBL_PH_SURBL 0 0.839 0 2.000body Contains an URL listed in the OB SURBL blocklist

URIBL_OB_SURBL 0 1.996 0 3.213body Contains an URL listed in the AB SURBL blocklist

URIBL_AB_SURBL 0 2.007 0 0.417header From: address is in the auto white-list AWL

1header From: address is in the user's black-list USER_IN_BLACKLIST 100.000header From: address is in the user's white-list USER_IN_WHITELIST -100.000header From: address is in the default white-list USER_IN_DEF_WHITELIST -15.000header User is listed in 'blacklist_to' USER_IN_BLACKLIST_TO 10.000header User is listed in 'whitelist_to' USER_IN_WHITELIST_TO -6.000header User is listed in 'more_spam_to' USER_IN_MORE_SPAM_TO -20.000header User is listed in 'all_spam_to' USER_IN_ALL_SPAM_TO -100.000

• Recipients “vote” on email by opening it, by clicking it… even by bouncing it.

• Those votes inform ISPs’ view of how to treat all mailing that you send.• Does it have a large number of

invalid email addresses?• Do the recipients behave like they

care about this email? Or emails from you in general?

Third, it learns from the ballot box

• How do I maintain list hygiene?• Salsa cleanup tools• Outside-Salsa cleanup tools• Pruning and re-engaging

List Hygiene

• Correct typos and misspellings• Purge defunct mail domains• Suppress known spam traps• Data appends for personalization

Third-Party Data Append & Validation

http://www.xverify.com

http://www.towerdata.com

Pruning Time (Jennie Cell, 1955)

Proactively REMOVE supporters who are repeatedly hard-bouncing

Pruning & Re-engaging

• Request the Bounce Limit Configuration package from Salsa

• Configuration suggestion: max 4 hard bounces, 10 soft bounces

HARD BOUNCE

Bounce indicating a permanent failure: this email address will probably never be good.

Bounce Types

SOFT BOUNCE

Bounce indicating a temporary failure:

this email address didn’t work today, but

might tomorrow.

• Even if they legitimately opted in, if they’re no longer interested they’re OUT!

• Mail ISPs are putting this responsibility on the sender

Proactively REMOVE supporters

Advantages include…

Happier supporters

Better inbox

placement

Improved performance metrics

(Plus, you might be able to pay Salsa Labs less in the bargain.)

Step One:

Define a “disengaged” or “inactive” record

Use Salsa’s query tools to isolate a segment of non-performing emails and batch them into a group or tag.

Step Two:

Send a win-back message

Before you prune, give your inactives a chance to stay on your list with a targeted re-engagement email blast or two.

Step Three:

Wash those inactives right off your list.

CONTACT INFO

Read, learn, discuss – help.salsalabs.com

Training & Learning Team – [email protected]

Salsa Support – [email protected]

http://help.salsalabs.com/

mailto:[email protected]

mailto:[email protected]

THANK YOU!