From what sources do email spammers get their addresses?

Wikipedia mentions the following:

  • Harvesting email addresses from publicly available sources.
    • This includes web pages (web crawling), usenet posts, mailing list archives, DNS and WHOIS records
  • Guessing email addresses (directory harvest attack)
  • Asking people for their emails for one purpose, such as jokes of the day, and selling the email addresses elsewhere
  • Getting access to people's address books (which Quechup utilized)
  • Scanning an infected computer for email addresses.

Are there any other techniques used? Are any of the techniques above now obsolete?


You named some major ones. Another one you didn't really mention was companies that sell lists of addresses to other spammers. I think this is actually a big part of the problem and is something that is very hard to do anything about. There are also people just generally selling lists to people who want to try their hand at spamming and those people usually don't care where they got the addresses from or if those people have done business with them before or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.