Over the last decade, unsolicited bulk email, or spam, has transitioned from a minor nuisance to a major scourge, adversely affecting virtually every Internet user. While there is a considerable body of research focused on spam from the recipient's point of view, we understand considerably less about the sender's perspective: how spammers test, target, distribute and deliver a large spam campaign in practice.

In this talk, I will report on our exploration of a new methodology – distribution infiltration – for measuring spam campaigns from the inside. By hooking into a botnet's command-and-control (C&C) protocol, one can infiltrate a spammer's distribution platform and measure various aspects of spam campaigns as they occur. I will present an initial analysis of spam campaigns conducted by the Storm botnet, based on data we captured by infiltrating its distribution platform, including such aspects as address harvesting, the template language employed, and dynamic aspects such as target list and campaign sizes.