PharmaLeaks: Understanding the Business of Online Pharmaceutical Affiliate Programs

TitlePharmaLeaks: Understanding the Business of Online Pharmaceutical Affiliate Programs
Publication TypeConference Paper
Year of Publication2012
AuthorsMcCoy, D., Pitsillidis A., Jordan G., Weaver N., Kreibich C., Krebs B., Voelker G. M., Savage S., & Levchenko K.
Other Numbers3314

Online sales of counterfeit or unauthorized products drive a robust underground advertising industry that includes email spam, "black hat" search engine optimization, forum abuse and so on. Virtually everyone has encountered enticements to purchase drugs, prescription free, from an online “Canadian Pharmacy.” However, even though such sites are clearly economically motivated, the shape of the underlying business enterprise is not well understood precisely because it is "underground. In this paper we exploit a rare opportunity to view three such organizations—the GlavMed, SpamIt and RX-Promotion pharmaceutical affiliate programs— from the inside. Using "ground truth" data sets including four years of raw transaction logs covering over $170 million in sales, we provide an in-depth empirical analysis of worldwide consumer demand, the key role of independent third-party advertisers, and a detailed cost accounting of the overall business model.


This work was partially supported by funding provided to ICSI through National Science Foundation grants CNS: 0433702 (“CCIED: Center for Internet Epidemiology and Defenses”) and CNS: 0905631 ("Invigorating Empirical Network Research via Mediated Trace Analysis"). Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors or originators and do not necessarily reflect the views of the National Science Foundation.

Bibliographic Notes

Proceedings of the 21st USENIX Security Symposium, Bellevue, Washington

Abbreviated Authors

D. McCoy, A. Pitsillidis, G. Jordan, N. Weaver, C. Kreibich, B. Krebs, G. M. Voelker, S. Savage, and K. Levchenko

ICSI Research Group

Networking and Security

ICSI Publication Type

Article in conference proceedings