Where do spammers get my email address?

Spam rarely means someone singled you out. Your address got into a list, and lists get combined, copied and sold. Knowing the main routes in helps you decide which ones are worth closing and which you simply have to filter. This guide covers where addresses come from. For why the volume climbs and what cuts it, see why do I get so much spam; for keeping published addresses like info@ usable, see how to protect public email addresses from spam.

How do spammers get email addresses?

Website harvesting: still the classic route

Spammers have scraped websites for addresses since the early days of spam. In the FTC's "Spam Harvest", run with law enforcement partners, investigators planted undercover addresses in 175 places online and monitored them for six weeks. The FTC reported in November 2002 that "Eighty-six percent of the e-mail addresses posted at newsgroups and Web pages received spam". The figure is old, but the method hasn't changed: anything public and machine-readable gets collected.

It's not just web pages. Addresses turn up in PDFs, slide decks, press releases, staff bios, job adverts, code repositories and the metadata of shared documents. Old pages that nobody remembers publishing are a common source.

US law treats harvesting as an aggravating factor. Under 15 U.S.C. § 7704(b), part of CAN-SPAM, unlawful commercial email is treated more seriously if the address "was obtained using an automated means from an Internet website or proprietary online service operated by another person" that promised not to share addresses. That deters some senders. It does nothing about spammers outside US reach.

Data breaches: your address leaks through someone else

Every service you've signed up for holds your address. When one is breached, its user list often ends up traded or published. The UK NCSC's data breach guidance warns that "Criminals can then use this information when creating phishing messages", and that criminals "will exploit high profile breaches" by impersonating the affected company.

To see whether an address appears in known public breaches, the NCSC says "there are a number of online tools that you can use" and links to Have I Been Pwned as an example. A result tells you which breaches exposed the address and often what else leaked with it, such as passwords or phone numbers.

What a breach means for you:

1. Expect more spam and phishing, some of it mentioning the breached service or quoting details from it.
2. Change any reused password. The NCSC says that if a message includes an old password "that you still use, you should change it as soon as you can".
3. Turn on MFA for the email account itself, which is the key to resetting everything else.

Guessing: role addresses and name patterns

Spammers don't need to find your address if they can predict it.

Role addresses

RFC 2142, published in 1997, standardized mailbox names such as INFO, SALES, SUPPORT, ABUSE and POSTMASTER. A spammer can send to info@ at every domain on a list without visiting a single website. Role addresses always attract spam for this reason.

Dictionary attacks

Automated tools also generate likely addresses by combining common first names, surnames, initials and numbers. CAN-SPAM names this too: addresses obtained by automated means that generate "possible electronic mail addresses by combining names, letters, or numbers into numerous permutations." If your company uses first.last@, one known address plus a staff list from your website or a social network gives away everyone else's.

Checking which guesses work

Some servers reveal whether an address exists. RFC 5321, section 7.3 notes that sites may disable the SMTP VRFY and EXPN commands "for security reasons", but adds that "in many cases, RCPT commands can be used to obtain the same information about address validity." MITRE ATT&CK's email address technique also describes attackers probing authentication services and public Microsoft 365 endpoints to confirm valid addresses.

That doesn't mean you should accept mail for addresses that don't exist. A catch-all address turns every guess into a delivered message and hides nothing, because a spammer can send to all the guesses anyway. Rejecting unknown recipients and filtering what's left is the better trade.

Mailing lists, forums and group archives

Public mailing list archives and forum posts expose addresses to anyone who reads them. RFC 5321 noted back in 2008 that "the contents of mailing lists have become popular as an address information source for so-called 'spammers'." If you post to public lists, use an address you're prepared to see in spam, or one the list displays in masked form.

Compromised contacts and their address books

Your address sits in the mailboxes of everyone you've emailed. When one of them is hacked, the attacker can read their contacts and conversations and send from their account. Microsoft notes that attackers "often use a compromised user's mailbox to send to recipients inside and outside of the organization" (Microsoft Learn).

This is how you get phishing from a real supplier, sometimes replying in a real thread. It's the hardest kind to spot, and the subject of our guides to email thread hijacking and business email compromise. There's nothing you can do to keep your address out of other people's address books, so this is a job for filtering and for payment-verification habits.

Bought, rented and traded lists

Addresses gathered by any of these routes get merged, cleaned of bounces and sold or swapped. That's why spam to a new address can take off suddenly: it landed on one list, and that list was copied into others. Unsubscribing from an obvious spammer rarely gets you off these lists; see is it safe to unsubscribe from spam for when it's worth trying.

Public records: WHOIS, RDAP and business listings

For years, registering a domain published the owner's name, address, phone and email in WHOIS, and spammers collected it. That has changed a lot:

• ICANN's Registration Data Policy, effective 21 August 2025, provides for redacting the registrant's email. A registrar that redacts it "MUST Publish an email address or a link to a web form to facilitate email communication" that does not identify the contact.
• ICANN says that from 28 January 2025, RDAP became "the definitive source for delivering generic top-level domain name (gTLD) registration information in place of sunsetted WHOIS services" (ICANN).

Records collected before redaction may still circulate, and country-code domains follow their own rules. Business registries, trade directories, professional listings and social profiles can also expose addresses. MITRE lists social media among the public sources attackers use.

Check what your registrar publishes for your domain. If it shows a personal address, switch the registrant contact to a role address such as domains@ and turn on the registrar's privacy option where one exists.

How can you tell which source leaked an address?

Often you can't be certain, but a few clues narrow it down:

Look at the To and Delivered-To headers, not just the display, to see exactly which address variant the message was sent to. Our guide to how to read email headers shows where they are, and the Email Header Analyzer lays them out for you.

Plus addressing is the simplest way to build this evidence for the future. Exchange Online and Gmail both deliver name+tag@ to the normal mailbox, so you can give each sign-up its own tag at no cost. If a form won't accept the plus sign, a separate alias does the same job. It isn't secret, since anyone can strip the tag, but it tells you who leaked first.

How can you reduce exposure?

You can't make a working address secret, but you can control how far each one spreads and how much damage a leak does.

1. Publish role addresses, not personal ones. Route info@ and sales@ to shared mailboxes.
2. Use separate aliases for different channels (website, print, events) so you can see which one leaked and retire it.
3. Use plus addressing or aliases for sign-ups, so a breached service reveals itself.
4. Turn off any catch-all and reject unknown recipients.
5. Keep staff directories and address formats off public pages where you can.
6. Use unique passwords and MFA so a breach exposes only an address, not an account.
7. Check old content: PDFs, archived pages and repositories often hold forgotten addresses.
8. Filter every mailbox at the domain level. Exposure is permanent; filtering is what stops the result reaching people. See how spam filters work.

Next steps

• Search your own website and documents for addresses you didn't mean to publish.
• Check whether your main addresses appear in public breaches, and change any reused passwords.
• Confirm your domain doesn't accept mail for made-up addresses, and check its records with the free Email Health Check.
• If spam has outgrown what built-in filtering handles, read how to stop spam for a whole domain. iBlockSpam filters every mailbox on a domain at the MX, with a per-user quarantine and digests.

Browse our other email basics guides.