Spammers get 0.000008% response rate, still make $$$

Even with only about one in about 12,500,000 junk mails resulting in a sale, spammers still make a profit. The good news? The margins are pretty thin.

The BBC reports that researchers from the University of California, Berkeley and UCSD actually infiltrated a massive network of hijacked PCs—called "Storm," in this case—to discover how many users actually respond to junk e-mail messages, as well as how much the average campaign grosses. (Ars Technica has more details on how the team actually hacked into Storm.)

After 26 days—during which the researchers tried to lure users to a fake pharmacy with an herbal libido remedy (fully guaranteed!)—the team managed to send out a whopping 350 million messages, but got only 28 sales in return, according to the BBC. (No, the researchers didn't actually make any money; anyone who tried to submit their credit card details just got an error message.)

So, let's see here … each herbal remedy sold for about $100, and the researchers got about one sale a day. Times that out by the size of the Storm botnet (which controlled about a million PCs at one point), and you get … about $7,000 a day (according to the BBC story), or about $2 million a year.

That's real money, but a far cry from the mountains of cash that some had feared—and as the researchers wrote in their reports, the margins are "meager enough" that spammers are "economically susceptible to new defenses," such as (I'm guessing) new and better spam filters. Aw, poor babies!

And as to the ethics of the USB and UCSD infiltrating Storm and sending out more than 350 million spam messages of their own? Well, as the researchers wrote (by way of the BBC), "The best way to measure spam is to be a spammer." Or, in other words, "Takes one to know one."

Related:
Study shows how spammers cash in [BBC]