The Harvester, the Botmaster, and the Spammer: On the Relations Between the Different Actors in the Spam Landscape

A spammer needs three elements to run a spam operation: a list of victim email addresses, content to be sent, and a bot-net to send it. Each of these three elements are critical for the success of the spam operation: a good email list should be composed of valid email addresses, a good email content should be both convincing to the reader and evades anti-spam filters, and a good botnet should efficiently sent spam. Given how critical these three elements are, figures special-ized on each of these elements have emerged in the spam ecosystem. Email harvesters crawl the web and compile email lists, botmasters infect victim computers and main-tain efficient botnets for spam dissemination, and spammers rent botnets and buy email lists to run spam campaigns. Previous research suggested that email harvesters and bot-masters sell their services to spammers in a prosperous un-derground economy. No rigorous research has been per-formed, however, on understanding the relations between these three actors. This paper aims to shed some light on the relations between harvesters, botmasters, and spam-mers. By disseminating email addresses on the Internet, fingerprinting the botnets that contact these addresses, and looking at the content of these emails, we can infer the re-lations between the actors involved in the spam ecosystem. Our observations can be used by researchers to develop more effective anti-spam systems. Categories and Subject Descriptors K.4.1 [Computers and Society]: Abuse and crime involv-ing computer