Bad Trip: Tales from an Accidental Spam Kingpin

Katje (not her real name) was CTO of an affiliate spam operation some years ago. She has long since moved on, but agreed to be interviewed about her experiences. This interview has been edited for clarity. Andrew: How did you get into the spam business? Katje: Right after I had the most boring job I'd ever had, I had fallen in love with this guy and I did “E” [aka Ecstasy, MDMA, Molly] with him for the first time shortly before we broke up. I felt like I had never loved anyone like that, and someone told me about “E love”. So I had the idea in my head that if I did E often enough I would eventually fall in love with someone else, and then I wouldn't feel sad over this relationship ending anymore. At the time, I didn't think that it was possible for me to fall in love with someone like that without MDMA being involved.

So since I had a friend who was a chemist who I was doing sales for, I was doing Molly basically as often as possible until it stopped working, which was three or four days a week. The third or fourth day I would do Molly and just feel horrible and have no positive feeling from it and then I would be in agony, you know, replenishing my serotonin for days until it would start working again. I don't recommend it to anyone. During that time I went out for coffee in a nice cafe on Dolores Street and I overhear this guy on the phone and he was talking about blocks of IPs, getting very confused, and someone on the phone kept asking him questions he couldn’t seem to answer. At some point he asked the guy what a /24 was, and he didn’t seem to know what that meant even after the guy on the phone tried to explain. So, when he got off the phone I went up to him and I was explaining to him about what a Class C was and how they allocated IP addresses and all that. Afterwards, he's like, “Do you want a job?” I was like thinking about what my lifestyle was at the time and I was like, “You probably don't want me for your job. What's the job?” He's like, “Well, we need help with technical stuff.” “Okay, what does your company do?” “We’re a marketing company.” “What kind of marketing do you do?” “We basically do mailing.” “So you’re a spammer?” And he's like, “No, no, no, it's all opt-in. Blah, blah, blah.” I'm a little incredulous about this, but I'm also fairly hung over from doing Molly all the time. So I kind of don't believe it, but then he's a sales guy so he gets me to believe him eventually, and I go off and I start working with them. Within a couple of weeks, I realized that this is not opt-in at all. They were, in fact, spammers. Andrew: What did you do for them?

Katje: One of my main jobs at the company was getting new servers up and running. They would constantly need new co-located systems or virtual servers and I would call up some ISP and I would invent a fictional project. Since I'd project managed a lot of projects at an ISP before, it was very easy to do this. I’d explain to them that we were working on a virtual hosting platform where people could host their domains and we needed a bunch of static IPs in order to do that, or some other random nonsense project. So we were going to need a class C for that and that was important because when you spam on IPs they quickly become blacklisted. So just as soon as deliverability went down on almost all the available IPs, we would move on to the next ISP. They were a little mistrustful about needing lots of IPs for obvious reasons, but since they were talking to someone who actually did projects like that it was more believable, I think. I’m a little embarrassed to say, at some point I started enjoying talking to ISPs about imaginary projects. Their staff sometimes became genuinely enthusiastic about what we were claiming to do to get our blocks of IPs So unlike pretty much any other job I can imagine, I would wake up whatever time I woke up after my ecstasy binge and I would start working on their stuff. I would study which messages went through and which didn't, and I would try and improve deliverability. I'm trying really hard right now to remember. I think the [spam] industry standard for deliverability is one in a thousand messages is considered good. By the end of my four months there, we had four times the industry standard for deliverability. Andrew: How did you feel about that? Katje: That was horrifying to me because I knew that hard drive space having to get bigger and bigger has to do with porn and spam. I knew that my participating in spam was contributing to the E-waste that was poisoning the environment. That did not make me feel proud of myself when I woke up in the morning. Knowing the deliverability really was so low is like, wow, the amount of garbage, it takes for them to make money is insane. This was a while ago, so perhaps deliverability has gotten better, but I don't know. I would be responsible for taking these virtual servers and setting up all the software that they would use for spamming on them. Then there was this guy in New Zealand and another guy in Texas and they were the ones who were expert spammers. They would take the campaigns, and they would write the message text, and they would pick the times to send them out when people are most likely to open them. So, I think it was like one in a thousand or so emails hit an inbox at all, as opposed to a spam folder, and then one in hundred of those actually got opened so that’s just an incredible amount of annoyance for a very small amount of profit. Then there was the conversion rate beyond that. It was different with every campaign. You could look at any given campaign and see how many people converted and it was a really small number. So the proportion of annoyance to profit is insane. Andrew: Apart from switching to other IP addresses, what other techniques were you using to improve deliverability? Katje: We were working on making it so that each sentence in the email would say something different. If you had a five-sentence paragraph, they were interchangeable and they would put random ones in so that it wouldn't be an exact match for everyone. That's what I was doing around the time I quit doing this job. So we didn't actually get that implemented. I was studying which messages went through and which didn't. I could send them to Yahoo and Gmail accounts and see if they hit the spam folder or not, and play with rewriting them, and work with the people who actually wrote the messages in the first place. So we were essentially studying what went through and what didn't. We were also checking to see if any of our IP addresses were getting blacklisted. We did personalize the messages. We would put people's names in them when we had names. “Hi, whatever their name is,” and then junk explaining what their awesome offer was, and that helped them with spam filters then. I don't know if it still does. Andrew: How many people were working for the company altogether? Katje: We were eight altogether. There was the marketing guy who had all the relationships with these big websites [affiliate networks] where you can get banners to put on your website and make money when people click through. You can also email stuff. It's all supposed to be opt-in. They buy lists, but they say that they don't.

Some of them, it'll be like 60 cents if they convert, some 30 cents, some of them $3. The marketing guy would monitor all of the messages and see what paid out the most. If you wanted to target spammers it might actually make sense to get on those affiliate networks and see what was paying the most and scan for those keywords and see how well that hit, because the ones that pay the most are the ones they're most interested in spamming you for. I wonder if you've interacted with the affiliate networks at all? Andrew: Yes. Some of them will turn a blind eye to spam and click fraud. Katje: I know one of the things that that the head of that spam ring was really concerned about was whether or not people were going to find out that he was using lists and stuff because he could get kicked off of the better affiliate networks. I wonder if there could be more collaboration with the affiliate networks. On some level, they know that they're turning a blind eye to this, but I don't think they want to be known for it. Andrew: There are definitely good guys and bad guys in affiliate networks. Katje: There are more and less profitable affiliate networks, and so if he got kicked off one then he worried that he might end up on ones that didn't have as high a rate of pay for conversions. Some had dramatically higher payouts for the same campaign. Andrew: The other people working for the company, what were they doing? Katje: We had a guy in New Zealand and he was an expert at figuring out when to mail and what to write and which campaigns to pick. He worked three hours a day and made good money and could live in New Zealand and work whenever he wanted. Oftentimes, we'd have meetings, he just wouldn't bother being there at that time. That leads into something I want to mention, which is, I think the reason a lot of people do this is because of the freedom of it. We had a couple guys in Texas. We had someone in Southern California who I didn't interact with that much. Andrew: How did these people all over the country and all over the world find each other in the first place? Katje: They wanted to build a business together. I know they had worked with each other before, most of them, but I don't remember the full stories on that if I ever knew it. Andrew: So you were promoting legitimate products from genuine affiliate networks? Were you also promoting anything questionable? Katje: “Click here to get a free credit card!” It's these sort of mildly scammy things that seemed to pay the most. I can't tell you whether or not they were legitimate products. Some of them obviously weren't because it's not as though I was ordering the things that we were setting up these messages for. But the affiliate networks were legal entities. So we weren't doing the super messed-up install-a-virus-on-your-computer type spamming or anything like that. Andrew: What was the attitude of the other people to what they were doing? Katje: They didn't care. It made money. When I would mention concerns about what we were doing, it didn't bother them. The guy living New Zealand, who I interacted with a lot... He got to travel and live anywhere he wanted. The guy who started the company who recruited me, he would tell me, “You know you can live anywhere in the world and do this, you can go anywhere you want.” I think he could see I wasn’t entirely cool with things, so he was trying to convince me that, in fact, this was a good lifestyle that I wanted to participate in. I think that might be how they sell people on doing this. I don't think anyone is a small child saying, “I want to be a spammer someday, that would be so awesome! Won’t mom be so proud!” Andrew: Do you have any idea what sort of money the spammers were making? Katje: I don't know what other people were getting paid, and unfortunately, I don't remember what I was getting paid either. I was doing a lot of Molly. It was enough to have a nice one-bedroom apartment in the Mission [District of San Francisco], maid service, go party at the best clubs in the city, buy lots of nice shoes and plenty of drugs to share with my friends.

Andrew: How were the profits of the company divided between the various people? Were you on salary, or were you getting a percentage? Katje: I was salaried. But if I wanted to set up mail campaigns and pick what was mailed on, then I would get paid a percentage of that. I never really ended up doing that. I mostly did a bunch of test campaigns. I didn't feel like I understood the mind of someone who would click on something that said, “Click here to get your free gift cards”. I didn’t relate to that demographic, I guess. Andrew: How long were you typically able to use a particular hosting company? Katje: The IPs would get blacklisted within two or three months. At that point, it was very difficult to get the hosting company to assign new IPs. So we would set up with a new hosting company as soon as the IPS were almost all blacklisted. We would check each one and use the ones that weren't blacklisted to send emails. When there were none left, we were done with that hosting company. Andrew: Did you pay for the hosting or did you stiff them when you moved on? Katje: The guy who was in charge, who had all the relationships with the affiliate marketing thingies, this was his operation. He paid the hosting companies. He thought of it as being like a normal business. Andrew: Did you ever have any problems with law enforcement or any legal actions? Katje: No, not that I heard of, but I was only there for four months before I quit. Andrew: What made you decide to get out of the business? Katje: I actually had a frank discussion with a good friend of mine, who I like and respect a lot. He's a very talented electrical engineer who’s designed stuff you see on a daily basis. I was complaining about doing the spam stuff. He would listen, then one day he takes me aside and he very seriously says to me, “Your mind is a weapon, and you have to choose whether you're going to use it for good or evil.” I laughed because I thought he was joking. He’s a pretty smart guy, so him telling me my mind is weapon is a very nice compliment, really. He was being playful. But he was serious.

I was doing very well. I was the CTO of that little spam ring, officially. Our deliverability had improved really quickly, and our ability to get IPs had improved quickly too. So he did have a point, in that it didn't seem like there were people available who could do these things from the people the long-time-spammers knew, and they'd been doing this for many years... So I thought about this and I was like, “I don't know, good and evil? That's a little dramatic,” but I basically stopped being able to get up in the morning. Like when I thought about getting out of bed to do my job enabling spam, I couldn’t move. Generally I'm proud of what I do, but at that moment in time, the product of my labor was annoying people and making tiny amounts of money off of the massive amount of people who are annoyed by what I was doing. And causing mail servers to need larger hard drives. That felt shitty. I would feel less motivated about doing my work. I like to do a good job at things, and get them done, and feel proud of myself, but that paled in comparison to how lame what I was doing was. So I eventually told the guy that I couldn't do it anymore. I literally could not convince myself to get out of bed to get on my computer and do this not very challenging nonsense.