1

2

3

4

5

Marketplace Ads for Goods

Marketplace Ads for Services

6

7

Types of Storm C&C Messages

• Activation (report from bot to botmaster)• Email address harvests• Spamming instructions• Delivery reports• DDoS instructions• FastFlux instructions• HTTP proxy instructions• Sniffed passwords report• IFRAME injection/report

8

9

10

Spamalytics

Who is targeted?Who is targeted?

19

• Top 20 domains

• Many Web mail & broadbandproviders, but very long tail

• Campaigns have nearly identicaldistributions

• Same scammers, or targetlists sold to multiplescammers

• Also see spam campaigns sentsolely to test accounts

11

12

13

Courtesy Stuart Brownmodernlifeisrubbish.co.uk

Anatomy of a modern PharmaAnatomy of a modern Pharmaspam campaignspam campaign