Scrapers, How and Modern Situation
As oppose to other answers, scraping is a very old method, and modern scrapers will have rules for scraping. There are many tools in existence like wpoison and due to this reason most scrapers will have limits on the number of redirects for current links (as this depends on how much the poisoner can fake the reality of the new page, for example if it is the same subdomain
fake2.domain.com, it is a flag for the scraper.) Also some scrapers will only scrape emails from white-listed websites, such as facebook.com if it were to list any emails, or more.
Also, as a spammer, I would come and manually look at the list of emails I scraped being real or not. For example, I have a scraper tool I would be using for months, and after a day, or few days, depends on my will really, I would go and look up on the
mailList.txt that I scraped so far, to tell if the mails are real. If the poisoner creates mails such as,
[email protected] I would manually see it, check from which links I obtained them from, and put rules on that link. So a fake list would look like this
And if I get these from a
somePoisonerDomain.com I would black list that link from my mail scraper. Manually.
Next, Scraping Data From Inside Businesses
If a malicious hacker wanted to scrape mails from a specific business, the hacker could only need access to one email from that domain, such as
[email protected] with login credentials. Then after logging in, it can scrape through available e-mails to send within that business domain, as most business offer this solution. Example picture
My school domain can be seen there, but it is not an issue. And it uses gmail as its mail service. As you see if I write
a it will give me all emails containing that. So a hacker can automate writing, starting from
a, aa, ab and scrape all of the emails in existence. A hacker only needs one email from inside, so if you are a business owner, make sure to remind your employees about this, so that they keep strong passwords and do not surf any malicious links!
Indeed I coded a business email scraper for outlook. I used selenium, you could use any automated browser tool. Normally this is supposed to be confidential information, but I share this for education purposes. Same could be done on google's gmail, or any other platform that supports prospective email listing upon key entry.
Going Back To SpamTrappers and Real Case Use of Email Addresses
Billionaire companies such as Google for sure have spam trappers working in the background, they either implanted them on their services or most obviously, they have filtering method on their mail services like gmail. So if a spammer was to send the same exact mails to many emails from many different emails, the email content would get marked as a spam. If that makes sense, on gmail, a single email is allowed to send around 500 mails a day, and you'd want to send 10 thousand mails, you either wait 20 days, or you use 20 different accounts to send 500 mails from each. Second option is more suspicious, and your mail content will go to spam. As a spammer, what you would want to do is change the contents that are being sent from each mail, by either adding extra text, images, html etc... As a note: from a spammer's viewpoint, using non famous domains to send spams will have higher chance to get trapped into filters, that is why current botnets like Emotet are using real people mail addresses from outlook.
Also, the mail addresses that the mails are being sent from could be not trustworhy, as in not white-listed yet. If it is a new email the google has confronted, they will put it to suspicious list. If the email has been used for many many years, and has many subscriptions from youtube, quora, twitter etc, google will know it is being used by a real person and will most and most likely not set the mails sent by that address to spam, unless receivers mark you as spam or your content is bad content. So the emails should be clean too. Otherwise they will end up in spam folder where most users avoid looking.
Next is database leaks, SQL injections
As a business owner, your emails are in your database, and if your database are leaked, you would be giving away all emails to hackers for spamming as well. And these are the most important emails, because these literally what make up your business, who are all your clients. You wouldn't be keeping fake emails in your database like those poisoner are generating on the page, even if you did, that'd be to some limit. (Which it could be an idea I thought about.) Make sure to keep your database as safe as possible, do not let any SQL injections or some sort, and do not give away your emails. The spammers in modern days, which I mean in 2023, mostly will target specific businesses instead of using scrapers. They either use the technique I told you above, or they try to get data from servers or databases. So yes, email scraping is still a thing depending on its efficiency, and efficiency will most likely come from having specific targets due to many filters, and spamholes.
Make sure your servers are protected. Rest is Google's or Microsoft's job to decide if an incoming mail is spam or not. Or whatever mail service you are using, make sure they have good spam filters too. You will most likely be protected. And my program above hopefully tells you so many things, I could easily get mails like that, so get everyone in your company protected.