How did the spammer get my email address?
Spammers and malware authors use a myriad of ways in which to capture user email addresses, below are some of the ways this can happen:
Crawling the web for the @ sign – Spammers and cybercriminals use sophisticated tools to scan the web and harvest email addresses. If you publicly post your email address online (forums, Facebook etc), a spammer will find it. Another tactic employed by spammers to discover email addresses is to search common sources. They have robots scanning web pages and following links. These address harvesting bots work a lot like the search engines’ robots, only they’re not after the page content at all. Strings with ‘@’ somewhere in the middle and a top-level domain at the end are all the spammers are interested in. Spammers are not fussy either, the pages they are particularly keen to visit are web forums, chat rooms, and web-based interfaces to Usenet because lots of email addresses are likely to be found there.
Making good guesses… and lots of them – Cybercriminals use tools to generate common usernames and pair them with common domains. These tools are similar to the ones used to crack passwords.
Friends & Colleagues – Even if you know better than to publicly post your email address on the web, it could still be stored in the email inbox of anyone who’s ever emailed you or whom you’ve ever emailed. Cyber criminals can steal contact lists, compromise devices or use social engineering to trick people into giving them access.
Buying lists – Spammers can purchase lists legally and illegally. When you sign up for a website or a service, make sure you read the privacy policy carefully to find out what the site plans to do with your email address.
Dictionary Attack – Big free email providers like Outlook.com or Yahoo! Mail are a spammer’s paradise, at least when it comes to finding addresses. Millions of users share one common domain name, so you already know that (“hotmail.com” in the case of Hotmail). Try to sign up for a new account and you will discover that guessing an existing username is not difficult either. Most short and good names are taken. So, to find email addresses at a large ISP, it’s enough to combine the domain name with a random username. Chances are both “asdf1@hotmailcom” and “asdf2@hotmail.com” exist.
Worms using infected devices: To avoid being detected and filtered, spammers seek to send their emails from a distributed network of computers. To build such a distributed network of devices, spammers cooperate with virus authors who equip their worms with small programs that can send bulk emails. Additionally, these spam-sending engines will often scan the user’s address book, web cache, and files for email addresses. That’s another chance for spammers to catch your address, and this one is particularly difficult to avoid.
So, as you can see from the above, sometimes the spammer does not know the user’s exact email address and is simply shotgun mailing or, the email address has been scrapped from an infected device.
Received a suspicious email? – contact us immediately at our office on 01253 808 472 or email our support desk so we can investigate.
