Spammers remain unrepentant as they make money

By PETER GRIFFIN

Captain Bob could be any teenage school-leaver, filling in the gap before university and a job in some computer-related field.

But the 19-year-old is possibly New Zealand's biggest spam-artist.

From his Mt Eden bedroom he sends unsolicited spam emails across the world by the million.

Captain Bob makes a living sending spam to addresses his business partners strip from the web - direct marketing from hell, you could say.

The gatherer of the addresses, a company with joint American and Russian ownership, uses software to "harvest" email addresses across the internet - from websites, mailing lists and email databases.

Programs are also available to randomly generate email addresses that have well-known domain name suffixes.

Addresses starting with info@, webmaster@ or sales@, followed by the domain, are obvious targets.

Known as a "dictionary attack" a spammer will connect to a mail server, bombarding it with a sequence of letters and numbers.

Sequences found to be active addresses are added to the spammers' list.

With millions of reserved addresses, the free email suppliers such as Hotmail, Yahoo and MSN are key targets, but Captain Bob says he generally steers away from them as the quality of leads generated is poor.

It is also his job to sort through the replies the emails trigger.

Filtering software makes the task easier, removing junk replies by targeting the abusive words that often appear in the messages of annoyed recipients.

From a million sent messages, Captain Bob says between 2000 and 3000 will respond asking to be removed from the mailing list.

"And I do remove them. Everyone who replies goes on the remove list," he says.

The process sees Captain Bob left with 150 to 200 genuine sales leads from interested people. A minuscule success rate, but enough to justify his fee - and to keep the spamming industry humming along.

The overheads are minimal. Captain Bob pays about $300 a month to maintain his server. He runs a Jetstart account ($65) to connect to his server which in turn connects to a high-capacity pipe out to the web.

He is paid US$300 ($577) for every million emails he sends, regardless of the response rate. His aim is to clear $1200 a day, working just a few days a month.

The money arrives through PayPal, the electronic transaction system.

"It goes from one online account to another online account and I withdraw the money from my bank account here."

But the spammer claims he is not looking to get rich from this dubious occupation - as some of his contacts overseas have.

"I just want to make enough to be able to do my own thing most of the time. I only started this a few months ago and it has all really come together," he says.

His aim is to upgrade his server so that he can send upwards of four million emails a day.

And Captain Bob doesn't see anything ethically wrong in his line of business.

"The internet wasn't designed for people to choose what they do and do not want to receive. But this is a very valuable medium and shouldn't be abused."

He claims the content of the emails he sends out advertise worthy services - he stays away from the penis-enlargement offers and Nigerian scams.

The emails he sends out offer the computer programming and web design skills of a Russian group charging a bargain rate of US$20 ($38) per hour.

With the European Union last year approving a ban on unsolicited commercial email and individual countries cracking down on spammers, Captain Bob's contacts had to find less-restricted areas to operate from.

"They used to send bulk email themselves but law changes have made it harder for them to do it."

In the US at least 26 states have passed laws to control spam, but there are no federal regulations beyond anti-fraud rules.

Captain Bob plans to move to the US - to a state such as Nevada, known as the spamming wild west.

Shutting spammers down is difficult. While spam traffic can be traced through the IP (internet protocol) address and the internet provider the spammer is using, switching IP addresses and provider allows them to carry on unhindered.

"They can trace me as much as they want. All they can do is disconnect me.

"The internet is vast, there's always places to send from," says Captain Bob, whose internet provider is aware of his activities.

Across town in another nice house in a middle-class suburb - another bedroom is cluttered with computer equipment.

This time the spammer's mother makes an appearance.

She is mildly alarmed that her son is sharing his spamming secrets with the Herald.

She has the look of a defeated woman.

Does she object to her 14-year-old son's online exploits?

"What can you do? You can't stop them from doing this," she offers before disappearing to vacuum the house.

The 14-year-old goes under the handle "^god".

He's been kicked out of half a dozen schools so far and spends his days at home in front of the computer.

A program called Mailbomb, designed to send email messages en masse, is his tool of trade. On a Jetstart 128Kbps internet account it might take him all day to spam to 298,000 addresses.

Like Captain Bob, ^god has no qualms about blitzing the world with spam.

"I don't know what the big fuss is for. Haven't they heard of the delete button?"

And he sees no real progress being made by anti-spammers.

"It's going to take years to make something that will completely stop it."

But he points to Spamarrest as a step in the right direction - if you hate receiving spam.

The system requires the e-mail sender to click a weblink returned by the Spamarrest user when they receive an email.

"No spammer is going to sit there clicking millions of links," says ^god.

But spamming is just one of ^god's pastimes. He also dabbles in online credit card fraud.

He claims to have purchased everything from domain names to computer gadgets using stolen credit card numbers at online merchants.

Last month fraudsters accessed more than eight million credit card account numbers when the network of a third-party payment company was compromised.

No theft occurred, but the breach was a startling reminder that in murky cyberspace, nothing is safe.

What it's worth

An Auckland spammer is paid US$300 ($577) per million spam e-mails he sends.

* A server upgrade will enable him to send four million spam emails a day.

* The software he uses to run his spam business is available on the web.

* Spammers stay mobile, changing internet protocol address and internet providers to avoid anti-spammers.

* An industry has emerged in developing anti-spam software, but none of the products blocks all spam.

* New Zealand has no anti-spamming laws. Europe and several state authorities in the US have introduced measures aimed at curbing the practice.

Spamarrest