Follow the spam

These are all real subject lines for spam messages I've received today alone. I've never been tempted to buy a fake watch from a spammer, but I've always wondered what would happen if I really did shell out the $49 for one of these AMAZ1NG R0L3X REPLICAS!!! Now I no longer have to: Computer Associates bought just such an item from a spammer, tracked the money, and reported the results for you to see.

The original spam, advertising a "T4g Heuer w4tch" for $200 from a place called Lagetyo.com, likely originated from a malware-infected PC sitting in a church in Washington state, almost certainly sent without the knowledge of the user. Clicking on the spam link, off our buyer was whisked to Lagetyo, a professional-looking (though merely temporary) website (see screenshot) which included a privacy policy, shopping cart, and contact details. Even the credit card transactions were encrypted.

A security audit showed that there was no malware in the site; everything was on the up and up. This makes sense: Once you have your victim on your grasp, you don't want to scare him off. He's about to give you his money (and credit card info) willingly. Why bother with malware now?

So he bought a pair of earrings on the site for $52 plus $29 shipping. Using software, web services, and good-old sleuthing to follow the money, which is a convoluted trip to China and Korea (where the websites he used were located), to a shell company in Las Vegas, to another shell company in Washington, and finally to the island of Cyprus, where the cash was collected.

Much to everyone's surprise, our hero's item was apparently actually shipped from China to him in Virginia according to shipment tracking information. Alas, there's a surprise ending, as the post office appears to have lost it only miles from his doorstep.

Surprised? I am. It's a much smaller crime to send spam email than to fraudulently charge someone's credit card. Maybe less lucrative, sure, but when it comes to spamming, I guess it really comes down to a question of risk.