Study shows how spammers cash in
Spammers are turning a profit despite only getting one response for every 12.5m e-mails they send, finds a study. — By hijacking a working spam network, US researchers have uncovered some of the economics of being a junk mailer.
Context & Ripple Effects
This study is the payoff to the researchers' earlier hijacking of the Storm Worm botnet, which let them observe a live spam campaign from the inside rather than estimate from outside. It converts spam from an anecdotal nuisance into a measured business: one response per 12.5 million emails still pencils out as profitable. The finding also fits the concentration picture already established by coverage showing ten spammers create 80 percent of spam — a small number of operators running industrial-scale campaigns.
First-order effects
- Spam operators get their first externally validated unit economics: conversion rates are vanishingly low, but near-zero marginal cost per email means even tiny response rates sustain the business.
- Researchers and anti-spam vendors gain hard data on botnet-driven campaign mechanics, replacing guesswork about how much junk mail actually earns its senders.
Second-order effects
- Defenders can shift focus from filtering messages to attacking the money: if profitability depends on a thin stream of conversions, chokepoints like payment processing become the target — later work found just three banks process 95% of spam transactions ([[a:1191498]]).
- The economics explain why botnet herding scales so aggressively — each infected PC can pump out hundreds of thousands of messages a day ([[a:1185145]]) — pushing ISPs and security firms toward takedowns rather than purely defensive filtering.
Third-order effects
- If spam survives on razor-thin conversion economics, the durable counter-strategy is financial, not technical: cutting off payment rails could collapse the business model faster than any filter.
- The hijack-the-botnet methodology points toward treating criminal networks as measurable economic systems, a template for subsequent end-to-end studies that traced actual purchases through the spam funnel ([[a:1191341]]).
The trend: Security research is shifting from counting spam volume to measuring the underground economy behind it, because following the money is proving more effective than blocking the messages.