Site icon The Mac Security Blog

Spam Doesn’t Pay. Or Does It?

You may wonder why you get so many spam messages every day. Several of Intego’s employees get 200-500 messages a day, and this without ever circulating their e-mail addresses in forums, mailing lists or on web sites. Somehow, once your e-mail address gets harvested, it multiplies faster than drosophila, getting sold from spammer to spammer, until everyone has it.

When you look at your spam, you may wonder just how it is that these messages trick people into buying anything. Many of them are written in broken English, which does not inspire much confidence, and contain poor-quality graphics, or strange typography designed to trick antispam software (such as Intego Personal Antispam, the intelligent antispam program). For example, would you give your credit card to a web site after receiving a spam for a “T4g H3uer repl1ca w4tch”? Or would you buy drugs from a spam saying “No Pre_script_ti0n Required!”?

If you’ve ever wondered just how much money spammers can make, you’re not alone. Some researchers from the Universities of California at Berkeley and San Diego carried out some tests early this year and came up with interesting statistics. Four four months, they infiltrated the Storm network that exploits infected PCs around the world to send out spam. Using more than 75,000 hijacked computers, they sent some 469 million spam messages in an attempt to sell an herbal libido-booster. To support their messages, they set up a fake pharmacy web site. They then waited for the results.

“After 26 days, and almost 350 million e-mail messages, only 28 sales resulted,” they said. That’s a response rate of around 0.00001%, abysmally low compared to, say, direct mail shots which generally have a response of around 2%. They calculated that if they were to exploit the full Storm network, this response rate would net some $7,000 a day, or $2 million a year. However, some other spammers report as much as 30% response rates by carefully targeting their messages to users of specific types of web sites.

To be fair, it’s hard to judge any specific spam message, such as the one the researchers used. Perhaps they were poorly crafted, or the vast majority of spams they sent were caught by spam filters. (Most ISPs use spam filters that catch the most obvious types of spam.) It’s also not clear how effective the “message” in the messages was; whether the marketing spiel used was strong enough to attract potential purchasers. But it does show that even with low response rates, a spammer can make a fair amount of money. With better-crafted messages, or with products that are more attractive, income can be very high.

It’s worth pointing out that spam campaigns tend to follow cycles. For a while, mortgage spams were all the rage; now that there’s a financial crisis, these have faded away. Increasing the size of body parts is an evergreen, as are the ads for products that improve one’s sex life, and those for pornographic web sites: sex sells. Recently there have been lots of pharmacy spams; ones trying to get Americans to buy prescription drugs, at a discount, from Canada. Pirated software is also a regular, as are sales of computers, cellphones and other tech devices. We’ve also seen a lot of spams for replica watches lately. One category of spams that is growing is messages from “women” who either want to chat or hook up with men. And we are seeing a number of messages purporting to be from women in countries like Russia and Ukraine looking to get married. The number of spams in languages other than English has exploded as Internet usage around the world increases. Chinese spams are increasingly common, joining Russian and Japanese in the top language lists. Obviously, the languages of the spams you receive depend a lot on where your address is harvested; if you visit non-English language web sites and post your e-mail address, you’re more likely to receive spams in those languages. But Chinese spams are very common, even for addresses that are just picked up by scraping web sites. And, of course, there are still seemingly intelligent people who get taken in by the Nigerian scam.

In any case, to keep your spam under control, you should use Intego Personal Antispam, the intelligent antispam program which learns from your spam and your valid e-mail to provide the best spam filtering for Mac.

Share this: