Former spammer: 'I know I'm going to hell'

"Ed," a retired spammer, built a considerable fortune sending e-mails that promoted pills, porn and casinos. At the peak of his power, Ed says he pulled in US$10,000 to $15,000 a week, storing the money in $20 bills in stacks of boxes.

It was a life of greed and excess, one that preyed especially on vulnerable people hoping to score drugs or win money gambling on the Internet. From when he was expelled from high school at 17 until he quit his spam career at 22, Ed -- who does not reveal his full name but sometimes goes by SpammerX -- was part of an electronic underworld profiting from the Internet via spam.

"Yes, I know I'm going to hell," said Ed, who spoke in London on Wednesday at an event hosted by IronPort Systems Inc., a security vendor now owned by Cisco Systems Inc. "I'm actually a really nice guy. Trust me."

A quick-witted and affable guy who wears an earring and casual clothes, there was a time when Ed wasn't so nice. He sent spam to recovering gambling addicts enticing them to gambling Web sites. He used e-mail addresses of people known to have bought antianxiety medication or antidepressants and targeted them with pharmaceutical spam.

In short, Ed said he was "basically what people hate about the Internet."

He spent 10 hours a day, seven days a week studying how to send spam and avoid filtering technologies in security software designed to weed out garbage e-mail. Most spam filters are effective 99 percent of the time; he aimed for that remaining window, using tricks such as including slightly different images in his spam, which can fool filters into thinking the e-mail is legitimate.

"The better I got at spam, the more money I made," Ed said.

He would start a spam run by finding an online merchant who wanted to sell a product. Then he'd acquire a list of e-mail addresses -- another commodity that has spawned its own market in the world of spam. He'd also set up a domain name, included as a link in a spam message, that, if clicked, would redirect the recipient to the merchant's Web site, enabling Ed to get credit for the referral.

The spam would then be sent from a network of hacker-controlled computers, called botnets. Those machines are often consumer PCs infected with malicious software that a hacker can control. Ed would "rent" time on those computers from another group of hackers that specialized in creating botnets.

If one of the spam recipients bought something, Ed would get a percentage of the sale. For pharmaceuticals the commission was around 50 percent, he said.

Response rates to spam tend to be a fraction of 1 percent. But Ed said he once got a 30 percent response rate for a campaign. The product? A niche type of adult entertainment: photos of fully clothed women popping balloons.

To track the money, merchants set up a "referral sales page" where spammers can see how much they make from a spam run. Ed would log in frequently, watching the money increase. He was paid into electronic payment transfer accounts, such as e-gold or PayPal, or into his debit card account, which he could cash out in $20 bills.

The IDG News Service is a Network World affiliate.