We are often asked whether we have any way of knowing how successful a particular malware or spam campaign has been. We assume that the “other side” tracks this sort of thing to see what social engineering works, and which material escapes spam and malware checks. (If any spammer is