LVCC Pump-and-Dump Case Study

Analysis of the spam emails 

Over one weekend I received 19 spam emails promoting a new over-the-counter stock.  This was the highest number of pump-and-dump spams I'd ever received for one stock, so I thought it might be interesting to study it.  Each spam contained the following message:

Firefox identified a few of these emails as spam and several real-time black hole lists identified a few, but most were not detected by anti-spam software.  The spam-generating software was impressive. I received the 19 emails on 3 different addresses (5, 6, and 8 sent to each address).  Each mail included the above text in a .gif image, but each was unique in every other respect.

• Headers:  The subject, sender, and return path was unique (and entirely fictional)
  
• Origin:  The received-from host name and IP address look real (probably sent from a botnet zombie).  Origins included USA, Hungary, Turkey, and France
  
• Time zones:  Most look real, ranging from -0400 (Washington) to +0300  (Ankara). 
  
• Mailer:  Supposedly Microsoft Outlook Express 6.00.something.  Some also said they used Exim 4.43.  Some Received lines may have been added by the sending software.
  
• Graphic:  a unique name for the .gif file
• Random text at the end for obfuscation
  

News on the Web about LVCC  

Trades  

History of share volumes and trade prices

Daily statistics

Speculation  

• Spam pumped up the initial price.
• The spammer didn't participate in the trading.
  
• The large trades were dumping by people within the company who owned shares before the IPO.