Security17.04.2016

How spammers get your email address

By Staff Writer

Unsolicited bulk email – known as spam – clogs up people’s inboxes and wastes a lot of bandwidth and resources.

ISPA said that spam is bad because users are forced to pay to download content they didn’t ask to receive.

“While ISPs bear the bulk of the cost for bandwidth overuse by spammers, this cost is often passed on to the consumer through increased Internet access fees or degraded service levels,” said ISPA.

But where do spammers get target email address, especially if users have never signed up for newsletters or other dubious services?

The answer is that email addresses can be obtained from many sources, including email address resellers and leaked lists. Methods include:

Website scraping – Spammers use tools to scan websites for email addresses, and collect these addresses for later use.
Calculated guesses – Spammers use tools to combine common names with popular domain names (like [email protected] or [email protected]).
Brute force an SMTP server – Spammers can brute force an SMTP server, trying common names for people and well-known accounts.
Setting up email capturing services – Spammers set up fake services to “subscribe to” or “unsubscribe online services” which capture your email address.
Stealing contact lists – Cybercriminals can steal contact lists from your friends, or trick them to give out this information.
Buying email lists – There are many email address resellers, which sell millions of email addresses to spammers or companies trying to promote their products.
Hacked websites – Many websites collect their users’ personal details, including email addresses. If these websites are compromised, the hackers can get access to the database where the email addresses are stored.
Leaked account databases – Employees with access to large user databases can leak this information, which includes email addresses.
Malware – Malware on a website or on someone’s computer can harvest email addresses.

What the South African law says about spam

ISPA’s Ant Brooks said that in terms of the law in South Africa, spamming is technically not illegal.

Current legislation says:

ECT Act: You must have an unsubscribe option, and you can’t spam someone who tells you to stop.
CPA: You must honour the (theoretical, because it doesn’t exist) national opt-out database, and you can’t charge anyone for opting out.
POPI: You cannot share or sell someone’s details without their permission. This would probably be the most powerful anti-spam protection currently available, except that POPI is not yet in effect.

How to protect against spammers harvesting your email address

While it is impossible to stop your email address from potentially landing up in a spam list, you can take steps to minimize the risk of it happening.

Keep your email private – Never publish your email address on websites or other public places, and never use it to sign up for services which you do not know well.
Use a disposable email address – If you want to gain access to an online resource which requires an email address, but do not trust the source, use a disposable email address.
Be careful to unsubscribe – Do not click on an unsubscribe link from spam messages or newsletters which you do not know.
Use an email address encoding tool – If you have to publish your email address on your website’s contact page, use an email address encoding tool to hide it from web scrapers.