About:
Messages offering discounts on "Canadian" pharmaceuticals traverse the internet by the millions, decreasing responsiveness to legitimate traffic at all network levels. People who respond to these messages are signed up to more spam and become subject to identity theft; those who purchase are subject to further identity theft and fake or misrepresented products.
Though this threat originates from Russian "Canadian Pharmacy" companies and their affiliates, it is distributed worldwide, with most campaigns targeting U.S. citizens. "Canadian Pharmacy" spam has been pandemic for a number of years, and has grown to be a significant percentage of all email sent. Recently, the spammers have had to move off of their Chinese call-to-action domains and have become more creative in the structure and the delivery of their messages.
Due to the volume of messages the spammers send out, they need only a small percentage of responses to be profitable. Offloading the message distribution to botnets decreases cost of distribution and automating message generation means few man-hours are needed to manage the campaign.
Some tricks that the spammers use:
- Use of botnets to distribute the spam
- Affiliate sites registered daily on "disposable" domains
- Hashbuster paragraphs – essentially “white noise” in email text added to make it seem less offensive to anti-spam filters)
- Use of newsletter-style templates with random words/non-words for the template text
- Short call-to-action paragraphs with dynamically generated generic text linking to affiliate sites
- Images advertising the pills linked to call-to-action domains
- Images rotate between varying styles, and have a hashbusting random noise generated background
- Images hosted on multiple free image hosting services
- Images included in message content
As the graphs show, China's tightened policies around domain registration do make an impact in spam distribution. Specifically, China now requires proof of Chinese citizenship in order to register .cn domains -- non-Chinese individuals and companies can no longer register a .cn domain. If other countries follow suit with their domain policies, this style of spam will become cost-prohibitive and will likely vanish.
Subject Line Samples:
### Monthly Sale, |emailid! Exclusive 80% off ###
For you only, emailid. Best 84% off prices
Help yourself being more sensual
Sales Event get 77% off
Special Discount 73% for emailid@domain.com
Surprise for emailid! 73% Off right now
Your Future Order with 76% off retail