Follow the Spam! What Happens if You Buy from a Spammer?

Find Top quality replica luxury watches
Massive Price Reduction Broad Assortment Generics
Candy for the kids

These are all real subject lines for spam messages I've received today alone. I've never actually been tempted to buy a fake watch from a spammer, but I've always wondered what would happen if I really did shell out the $49 for one of these AMAZ1NG R0L3X REPLICAS!!! Now I no longer have to: Computer Associates bought just such an item from a spammer, tracked the money, and reported the results for you to see just to see where the money actually went.

The original spam, advertising a "T4g Heuer w4tch" for $200 from a place called Lagetyo.com, likely originated from a malware-infected PC sitting in a church in Washington state, almost certainly sent without the knowledge of the user. Clicking on the spam link, off our buyer was whisked to Lagetyo, a professional-looking (though merely temporary) website (see screenshot), which included a privacy policy, a shopping cart, and contact details. Even the credit card transactions were encrypted.

A security audit showed that there was no malware in the site; everything was on the up and up. This makes sense: Once you have your victim on your grasp, you don't want to scare him off. He's about to give you his money (and credit card info) willingly. Why bother with malware now?

So he bought a pair of earrings on the site for $52 plus $29 shipping. And using software, web services, and good-old sleuthing he followed the money, taking a convoluted trip to China and Korea (where the websites he used were located), to a shell company in Las Vegas, to another shell company in Washington, and finally to the island of Cyprus, where the cash was collected. 

Much to everyone's surprise, our hero's item was possibly actually shipped from China to him in Virginia according to shipment tracking information from the shipper. Whether that information is legitimate, we'll never know. Either the post office lost the item, or more likely, it was never shipped at all and the shipping log was fake. Regardless, the money's gone, and he never got the product. And if it was shipped, what was actually in the box? We'll never know; the buyer dropped the case at this point.

The bottom line? Buying from a spam site just isn't worth the risk, no matter how good the deal seems.

LINK: Read the entire adventure here.