Welcome to MSDN Blogs Sign in | Join | Help

Terry Zink's Anti-spam Blog

Protecting your mail from the scum of the internet
How much do spammers actually make?

Spammer X is an ex-spammer who has written book called "Inside the Spam Cartel: Trade Secrets from the Dark Side."  He's a former spammer who retired in 2004 who has shared many of his tricks of the trade.

He presented at the Spam Symposium in Europe in 2007.  I wasn't there but I did watch the webcast.  He mentions that he retired because of the social overhead of being a spammer.  "You can't go up to a pretty girl in a bar and introduce yourself, and then reveal that you sell porn, pharmaceutical and mortgage spam.  It kills your social life pretty quickly," says Spammer X.

Anyhow, said spammer revealed just how much money he was making during his five years in the business.  Here it is below:

Spam Sent 40 million
Click through ratio 0.12%
Total Click-throughs 48,000
Click-through-to-sales ratio 1/200
Total sales 240
Total sales revenue $37,440.00
Spammer Commission rate 50% (Gah!)
Total spammer income $18,720.00
Weekly costs  
Bulletproof hosting $230
4 days of botnet access $6800
Email addresses $4000
Total Costs $11,030
Net Profit $7690

Let's round it down to $7000 per week, and assume that our spammer takes four weeks of vacation per year.  His net profit for the year?  $336,000. 

That's a pretty good chunk of change, and it's probably more than I'll ever make fighting spam... but the flip side is that I don't have the social overhead of having people punch me in the face when I tell them what I do.  In fact, I must say that in the eyes of many people, I may just be a super hero.

I don't have the power to manipulate space and time like Hiro Nakamura, but stopping a couple billion spam messages per day is nothing to sneeze at.

Posted: Thursday, August 28, 2008 10:36 PM by tzink
Filed under:

Comments

Rob McEwen said:

I think that, in many cases, the amount of money is small. HOWEVER--the problem here is that to some 17-year-old Russian kid, making a mere $500 off the commissions in sales from a botnet generated spam sent to 10 million people is like a professional in the U.S. getting an extra $10K bonus. So millions in the US and Europe get spammed... just so one punk Russian kid can make an extra $500 bucks.

In other cases, phishers have found that paying lackeys to spend 40+ hours a week *manually* sending spams (one-at-a-time) though freemail accounts actually pays off. All it take is one jackpot of several thousand dollars and, to them, that is like tens of thousands of dollars to you and me. And hitting tens of thousands of dollars is like millios to you and me. So, in the case of phishers, working this scheme days, or even weeks, between jackpots is still a very lucrative business.

And that level of manual touch one-by-one is why phishes are getting so hard to block these days. They can quickly change up a word here and there with each message and then bypass many rules-based filters and clearing house checksum filters. There is no URI for a spam filter to grab onto. And they send from large ISP or freemail ISPs, so the IP address doesn't help much.

A third one is the "snowshoe spammer", which are sometimes individuals, or unethical ESPs. I think this is where you'll find more Americans at work in the spamming business. That would have to be a profitable business, or else they'd not be doing it. This is the one I understand the least. They should know better and their efforts ought to be more profitable in a more honest venture. (you'd think!)

# August 29, 2008 12:06 AM

Michael Clark said:

So maybe we should start following all the links in the spam we get so we can increase their click-through rate, and maybe increase their "bulletproof hosting" costs, but definitely reduce their "click-through-to-sales ratio".

Your first comment on this post is spam.

# August 29, 2008 7:09 AM

kjopc said:

Perhaps there should be "white hat" spammers who re-take control of bots and innoculate the machines against further use by spammers.

# August 29, 2008 11:03 AM
Leave a Comment

(required) 

(required) 

(optional)

(required) 

Comment Notification

If you would like to receive an email when updates are made to this post, please register here

Subscribe to this post's comments using RSS

Page view tracker