How Do Spammers Get Email Addresses? The 7 Main Routes

Spammers get email addresses from data breaches, from lists that companies sell or share, by scraping websites and public profiles, by guessing common names, from other people’s address books, and from old domain registration records. Then they test which addresses are live by watching for opens, clicks, and replies. Spam can reach even an address you never gave out, through guessing, scraping, or someone else’s contacts, and only some of these routes are yours to close. For the routes that start with you, CatchNone gives every shop and newsletter its own address and shows which one each message reached, so a breach or list sale names its source, on iPhone, iPad, and Mac.

How spammers get email addresses: the 7 routes

1. Data breaches and the password lists built from them.
2. List sales and sharing, through data brokers and “partners.”
3. Scraping of web pages, social profiles, and code.
4. Guessing common names, especially on domains that accept any address.
5. Other people’s address books: contact uploads, malware, and long Cc chains.
6. Old WHOIS records from before 2018.
7. Confirmation: tracking images, clicks, replies, and blank test messages that prove an address works.

Data breaches and combo lists

When a company is breached, its customer list can go with it, whether or not you still use the service. Have I Been Pwned (HIBP) listed 1,038 breaches and more than 17.8 billion breached account records as of September 25, 2026. That total counts an address once for every breach it’s in, so it measures accounts, not people. Search your own address there to see which breaches include it, when they happened, and what was exposed. If it’s in none, a list sale, scraping, or guessing is more likely.

Breached addresses get reused. Combo lists are email-and-password pairs gathered from earlier breaches and used for credential stuffing, which means trying the same password on other sites. HIBP describes Collection #1 (2019) as “773 million unique email addresses alongside passwords those addresses had used on other breached services.” Stealer logs are a third source: malware on an infected device records “email addresses, passwords and the website they’re entered into at login.”

Can you close it? No. You can limit what one breach exposes: a unique password for every site, two-step verification on your email account, and a separate address for each company, so a breach exposes one spare address instead of your main one. HIBP’s free Notify Me alerts tell you about the next one.

List sales, data brokers, and “our partners”

The FTC puts it plainly: “When you give a company your email address, it might share or sell it to third parties.” Signup forms feed the same trade. The US Cybersecurity and Infrastructure Security Agency (CISA) notes that options to receive email about other products are sometimes selected by default, “so if you do not deselect them, you could begin to receive email from those lists as well.” Prize draws, paid surveys, and gift-card offers feed it too: HIBP says spam lists are frequently aggregated “by eliciting personal information from people with the promise of a monetary reward.”

Who buys email addresses? Marketers buy them from list sellers and data brokers, and spammers buy them from each other: the Spamhaus consumer FAQ names addresses “bought from other spammers” among their sources. Business lists are a product of their own. In 2016 a list of more than 33 million people in corporate America from Dun & Bradstreet’s NetProspex service leaked online, and D&B believed it was lost by a customer who had bought it.

In the US, CAN-SPAM requires no consent to send marketing email. Once you opt out, though, a company must stop emailing you within 10 business days, and from the moment you ask, it “can’t sell or transfer” your address.

Can you close it? Partly. Untick pre-selected boxes, opt out of marketing you don’t read, and give each company its own address, so the next sale shows who made it. How to find out who sold your email address covers headers, breach checks, and data-access requests in depth.

Scraping: websites, profiles, and code

“Spammers can harvest any email address posted on a website,” CISA warns. In a 2002 FTC experiment, 86% of the addresses posted on web pages received spam within six weeks, and one address posted in a chat room got spam nine minutes after its first use (results reprinted by ICANN). Where on the page it sat didn’t matter: “if the address had the ‘@’ sign in it, it drew spam.”

Profiles are scraped at scale. In 2021, attackers scraped hundreds of millions of public LinkedIn profiles, yielding about 125 million unique email addresses, according to HIBP. Attackers also abused a Twitter API that matched email addresses to accounts, and more than 200 million records gathered that way surfaced in 2023.

Public code exposes addresses too: every Git commit carries its author’s email address. On GitHub, go to Settings → Emails, select Keep my email addresses private and Block command line pushes that expose my email, then set Git on your computer to the @users.noreply.github.com address shown there. Commits made before the change “are still associated with your previous email address” (GitHub Docs). Keeping your address out of GitHub and GitLab commits has the full steps.

Can you close it? For the future. Keep your main address off public pages, use a contact form or a separate address instead, and set social profiles so only people you trust can see your email, as CISA advises. What’s already been scraped stays in circulation.

Guessing: can spammers just guess your address?

Yes, and it needs no list. ICANN’s security committee described the method in 2007: spammers try “individual and concatenated common given and surnames,” or every combination of characters, and keep the addresses a mail server accepts. This is called a directory harvest attack. In one of the committee’s tests, 70% of the spam went to addresses at the test domains that had never been published anywhere. Short, common names are the easiest targets, and a company’s first.last@example.com pattern lets anyone build addresses for its staff.

A catch-all accepts every guess. If your own domain delivers mail for any address, admin@example.com and info@example.com reach you whether or not you ever used them. The addy.io FAQ warns that “spammers and bots often try random email addresses,” and cPanel says a catch-all “may receive a large amount of spam” when spammers target a domain. What is a catch-all email address? covers the trade-offs in full.

Can you close it? Partly. A short, common address stays guessable, but your next one doesn’t have to be: choose one that’s hard to guess, as the UK’s ICO advises. On your own domain, turning the catch-all off stops guesses reaching you. If you keep it, block guessed names at your host. In Cloudflare Email Routing, for example, go to Compute → Email Service → Email Routing → Routing Rules and add a rule for the address with the action Drop, which “deletes emails matching the rule without routing them.” Cloudflare notes that the address still appears valid to senders; send a test message to confirm the rule wins over your catch-all.

Other people’s address books and inboxes

Your address sits in the contacts of everyone you’ve emailed, and those copies are out of your hands.

• Contact uploads. When someone syncs contacts with Facebook, Messenger, or Instagram, Meta uploads “the names, phone numbers and email addresses in their address book” daily, including those of people who don’t use Meta’s apps. That alone doesn’t hand it to spammers, but Meta says scrapers misused its contact importer before September 2019 to match phone numbers to accounts.
• Malware on someone else’s computer. The Emotet malware could “scrape email addresses from Outlook” and hijack real email threads to spread (CISA advisory AA20-280A).
• Cc chains and mailing lists. A long forward carries every address in the thread, and ICANN’s security committee described spammers joining mailing lists to collect addresses from the From, Reply-To, and Cc headers.
• Someone signs you up. Gmail’s help describes people using your address “to sign up for emails, like promotions or newsletters,” by accident or on purpose.

Can you close it? Not directly. Use Bcc for group mail, remove other people’s addresses from a thread before you forward it, and ask others to do the same.

Old WHOIS records

Domain registration records used to publish the owner’s email address. In 2007, ICANN’s security committee concluded that an address in WHOIS “virtually assures spam will be delivered.”

That route has mostly closed. From May 25, 2018, ICANN’s Temporary Specification had registrars redact contact details for registrations linked to Europe and let them do so everywhere else, offering a relay address or web form instead. A 2021 Interisle study found only 13.5% of generic domains, such as .com, still named a real registrant. ICANN’s permanent Registration Data Policy, in effect since August 21, 2025, keeps the same model.

The route still exists where you consented to publication, at registrars that publish data for organizations or registrants outside Europe, under some country-code domains’ own rules, and in paid archives of pre-2018 records.

Can you close it? Mostly closed by default. If you own a domain, look it up in ICANN Lookup to see what’s public, keep your registrar’s privacy option on, and don’t agree to publish your contact details.

Confirmation: opens, clicks, replies, and blank messages

An address is worth more once it’s known to work. Spammers “sell live addresses at a premium as ‘confirmed deliverable’ addresses to yet more spammers,” says the Spamhaus consumer FAQ. They confirm addresses through:

• Tracking images. “When your mail client downloads the graphic from their web server, the spammers know you’ve opened the message” (CISA).
• Clicks and replies. Any click or reply, including a “remove me” request, confirms that someone reads the address.
• Unsubscribe links. The one-click unsubscribe standard, RFC 8058, notes that unsubscribing “provides a strong hint to the mailer that the address to which the message was sent was valid.”
• Blank messages. “To check whether email addresses are valid, spammers often send emails with no content in the body or subject,” says Gmail’s help. The addresses that work get spam later.

Can you close it? Yes. For mail from strangers, don’t reply, click, or unsubscribe; report it as spam. For brands you recognize or signed up with, use your mail app’s Unsubscribe button, as Gmail suggests, or the opt-out in the message, as the ICO advises; when unsubscribe links are safe has the rule by sender.

Then keep images from giving you away. In Apple Mail on iPhone (iOS 27), go to Settings → Apps → Mail → Privacy Protection and turn on Protect Mail Activity, which loads images privately in the background so the sender can’t tell whether or when you read a message (Apple’s guide). In Gmail on a computer, go to Settings → See all settings, set Images to Ask before displaying external images, and click Save Changes (Google’s help). Neither covers links or attachments. How to block tracking pixels has the steps for other mail apps and what each one still reveals.

How to tell which route reached you

Bcc hides the other recipients, and Gmail’s help notes that “spammers sometimes add random email addresses into the ‘Bcc’ field to try to get people to respond,” so don’t.

Is there a spam list you can check or get off?

There’s no official list of spam recipients, and no way to get off spammers’ own lists. You can check whether your address turned up in a leaked spammer’s list: search it on Have I Been Pwned, which includes 16 such lists as of September 25, 2026. The largest are Onliner Spambot (711 million addresses, 2017) and River City Media (393 million, 2017). If one of those names appears in your results, a spammer had your address.

Blocklists are a different thing: they track where spam comes from. Spamhaus defines one as “a database containing IP addresses, domains, or hashes”, each listed because it was seen sending spam or doing other harm, or because it has a bad reputation. Its Hash Blocklist can include email addresses, but those are addresses sending spam or appearing in it, such as a hacked account. Blocklist checkers such as MxToolbox’s Blacklist Check test a mail server’s IP address, not your email address.

A do-not-email list wouldn’t help either. In 2004 the FTC told Congress that such a registry would likely backfire, because “spammers would use such a registry as a directory of valid email addresses” (FTC). Spamhaus calls paid services that promise to remove you from spammers’ lists “at best a scam and at worst a ‘live address’ confirmation system for the spammer.”

The nearest real options reach businesses that follow the law, not spammers. As of September 2026:

• California’s DROP (Delete Request and Opt-out Platform) lets California residents send one free deletion request to over 600 registered data brokers, which must process requests at least every 45 days. It doesn’t reach companies you dealt with directly (DROP’s terms).
• The Association of National Advertisers’ Email Preference Service, linked from DMAchoice.org, is free and lasts 10 years (FTC), but it reaches only marketers who use it to clean their lists.

What can someone do with just your email address?

Without your password, less than you might fear. With the address alone, someone can:

• send phishing that looks real, especially with details from a breach
• try passwords leaked from other sites against your accounts
• look up which services you use, as Twitter’s API once allowed
• sign you up for mail you never asked for
• sell it on, for more once it’s confirmed live

Why would a scammer want your email address?

Because it’s the first step toward your inbox, and a criminal inside your email account could “reset all your other account passwords.” The UK’s National Cyber Security Centre (NCSC) advises a strong, separate password for your email, plus two-step verification.

Spam showing your own address as the sender doesn’t prove anyone got in, because the From line is easy to forge. How to check whether your email account was hacked walks through the checks for Gmail, Outlook.com, and iCloud Mail.

Is it safe to give out your email address?

Usually, yes. An address isn’t a password, and knowing it doesn’t open your account. Give your main address to people and to companies you rely on, such as your bank. For shops, newsletters, and one-off signups, a separate address per company keeps breaches and list sales away from your main one, and your main address shouldn’t be posted publicly at all.

How to stop spammers getting your address: which routes you can close

You can get per-company addresses in several ways. CatchNone gives each company its own alias, keeps that mail out of your main inbox, and badges every message with the alias it reached, so a leak or sale shows up. Plus addressing is quicker to start, where your provider supports it (you+shop@example.com), but anyone can delete the tag, so it identifies a leak only when the sender doesn’t bother to strip it. Apple’s Hide My Email (part of iCloud+), DuckDuckGo Email Protection, and other alias services forward mail to your inbox. A catch-all on your own domain works too, with the guessing trade-off above. Email alias services compared sets out the differences.

Where CatchNone fits

CatchNone works on the routes that start with you handing over an address. Each shop, newsletter, or account gets its own alias, and every message is badged with the alias it reached, so a breached or sold address names its source. Activity points out mail on an unused alias and first-time senders, and remote images, including most tracking pixels, stay blocked until you load them. @catchnone.com addresses need Premium and are assigned at random, such as abcde-12345@catchnone.com, so nobody would guess them. Mail to addresses that don’t exist there is accepted and discarded, so a guesser learns nothing, and when you switch off an address that leaked, senders get a bounce. On your own domain, guessed catch-all addresses show up under the address they reached, with a gray badge, which makes dictionary spam easy to spot. Download CatchNone, available for iPhone, iPad, and Mac.

CatchNone is receive-only and isn’t a spam filter: it keeps signup mail in its own app, away from your main inbox, and shows which alias each message reached. On your own domain, marking an alias as not in use is only a label, so block addresses at your host.

FAQ

How do spammers get my email address if I never gave it out?

Most likely they guessed it, scraped it from a page, profile, or code commit where it was posted, took it from someone else’s address book, or got it from a company you once signed up with and forgot, through that company’s breach or a list sale. The table of signs matches what you see to the likely route.

How do random companies get my email address?

Usually from a company you did deal with, which shared or sold it to “partners,” often after you left a pre-selected box ticked at signup. Data brokers collect and sell addresses too. The guide linked under list sales and data brokers shows how to find which company it was.

How do spammers get my work email address?

From business contact lists sold to marketers, from your employer’s website, and by guessing its name pattern. HIBP holds several leaked business lists, such as B2B USA Businesses, which sorted addresses by employer and job title. In the UK, the ICO says organizations may send marketing to a work address without consent unless the address identifies you, in which case you can ask them to stop.