Why are there often random email addresses in known password word lists?

Question

In known wordlists like crackstation.lst there are random emails in the list. Why are they there?

Answer 1

There are a few reasons (and often all three are in play):

Larger wordlists are often dirty. Unless the list is specifically filtered for likely noise / "junk" - such as the Crackstation "human" variant - then a variety of other plaintexts often find their way into lists, simply because people are shoveling a large variety of data into their wordlists.

Larger hashlists are often dirty. Uncracked hashes that are submitted via a public interface or API are often taken from a variety of sources, including hashes of email addresses that are used - naively, or deliberately - as unique, normalized, semi-obfuscated tokens for a given platform. For example, Gravatar deliberately uses hashes of email addresses in URLs. An attacker who knows this will then try all sorts of common usernames and email domains, and crack many of them. This makes them end up in wordlists.

Some people literally use email addresses as their passwords. This is because they're easy to remember, and users (naively) think that someone might not guess that they're using their alternate email, or even someone else's email, as their password.

Answer 2

Presumably it's just people using their email address as their password..

Answer 3

There are two main reasons:

1. People using them for privacy

Some people are privacy oriented, and they will create random looking email addresses for different services. This way it's not easy to link all of its personas based on the email address.

2. They are fake and used to track leakage

They are called Copyright Traps. They are most common on maps and dictionaries, so anyone copying data from them would copy the fake streets or words too, and the owner of the data would know for sure who copied its information.

On leaks, sometimes the leaker will add fake emails that aren't expected to be found anywhere, and if anyone buys the data and leaks it later, the original "owner" of the data can know for sure who leaked the list by searching the traps on the leaked data.