Is email scraping still a thing for spammers

Question

I've run a website for barely three months now and put my emails on there. I also run a catch-all address on this domain. Since my website is online, I haven't received a single spam email on the addresses provided on the website.

So I'm wondering if email scraping is still a thing. Spammers still need means to somehow get new, fresh email addresses.

How do they do it if not with scraping (as one tool from many)? Yes, I know spammers can buy email lists or similar, but that's not the point. These email addresses that are inside those lists must have originated somewhere, and spammers need to find new email addresses, that's where this question is aiming at.

Answer 1

Scraping is still a technique spammers use to harvest victim addresses, but as there are far more methods today than there were a dozen+ years ago, scraping is no longer the primary mechanism to find spam victims. Data leaks (especially account dumps) are a good example of a more modern source of potential spam victims.

Additionally, spammers are now much more sophisticated in how they choose and then scrape websites. They used to discover pages to scrape the same way search engines did—by blindly following links. Nowadays, they can pump key phrases into search engines and filter the results before scraping. This means you have to wait to be indexed and then wait to be scraped. You shouldn't expect results quickly (if at all), though you might get lucky.

The Messaging, Malware, and Mobile Anti-Abuse Working group has put out a M³AAWG Best Current Practices For Building and Operating a Spamtrap document that may further assist you, though as seeding techniques are industry secrets, you won't find anything on that topic there (just vague references to an ancient tool called wpoison, which wasn't really a trap-seeding technique).

See also:

• Databases with spam, phishing email examples
• How can I get more spam for my honeypot?
• Search the web for seeding a spam trap

Answer 2

It is possible for automated scripts to find a site almost immediately. But it can also take a while.

As someone who ran honeypots for a long time, it was frustrating how long it could take to "get noticed". But once my site was "on the radar", my sites were hit constantly and emails scraped. And 3 months was not an unusual lead time.

As for other methods:

• it is possible to query email servers directly
• spam scripts don't need a valid email, they can just try every name/combination they can think of. Any email address that doesn't return an error goes on lists

Answer 3

Assuming we define "spam" as it has been traditionally, as unsolicited bulk email, and spammers as anyone who sends spam regardless of intention, then email scraping from regular websites is definitely a thing. There's also scraping from Git commits (often for sending surveys or job offers), OpenPGP keys, mailing list archives, and pretty much anything else that can contain an email address.

I've also seen email addresses harvested from data breaches as well, and some spammers get them by simply buying data from parties who have it. And, of course, there are companies who sign people up for mailing lists without their consent after a purchase.

All of these can take some time to happen, as schroeder said. Three months isn't unusual in any way.

Answer 4

One area where scraping is highly prevalent is in targeted phishing campaigns, where the scammers retrieve not just email addresses, but also other information from corporate websites, and then create an email campaign to target individuals at a lower tier in the corporate hierarchy with fake emails from higher ups, attempting to trick them into revealing credentials, approve transactions, or other criminal activities.

These are not huge mass-mailings to random addresses, but much smaller campaigns targeting a small number of employees at a specific company. Whether this meets the definition of spam is a matter of opinion, but it's definitely unsolicited email sent to random people for nefarious purposes.

A low-level employee might get an email from a corporate officer asking them to help by buying gift cards. A member of the accounting team might get a request to approve a bank transfer. The scammer always explains that they are in a meeting or traveling, so they can't talk directly, and often they want to move the conversation to SMS.

These scams are extremely profitable and effective.

Answer 5

Scrapers, How and Modern Situation

As oppose to other answers, scraping is a very old method, and modern scrapers will have rules for scraping. There are many tools in existence like wpoison and due to this reason most scrapers will have limits on the number of redirects for current links (as this depends on how much the poisoner can fake the reality of the new page, for example if it is the same subdomain fake1.domain.com and fake2.domain.com, it is a flag for the scraper.) Also some scrapers will only scrape emails from white-listed websites, such as facebook.com if it were to list any emails, or more.

Also, as a spammer, I would come and manually look at the list of emails I scraped being real or not. For example, I have a scraper tool I would be using for months, and after a day, or few days, depends on my will really, I would go and look up on the mailList.txt that I scraped so far, to tell if the mails are real. If the poisoner creates mails such as, [email protected]or [email protected] I would manually see it, check from which links I obtained them from, and put rules on that link. So a fake list would look like this

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

And if I get these from a somePoisonerDomain.com I would black list that link from my mail scraper. Manually.

Next, Scraping Data From Inside Businesses

If a malicious hacker wanted to scrape mails from a specific business, the hacker could only need access to one email from that domain, such as [email protected] with login credentials. Then after logging in, it can scrape through available e-mails to send within that business domain, as most business offer this solution. Example picture

My school domain can be seen there, but it is not an issue. And it uses gmail as its mail service. As you see if I write a it will give me all emails containing that. So a hacker can automate writing, starting from a, aa, ab and scrape all of the emails in existence. A hacker only needs one email from inside, so if you are a business owner, make sure to remind your employees about this, so that they keep strong passwords and do not surf any malicious links!

Indeed I coded a business email scraper for outlook. I used selenium, you could use any automated browser tool. Normally this is supposed to be confidential information, but I share this for education purposes. Same could be done on google's gmail, or any other platform that supports prospective email listing upon key entry.

Going Back To SpamTrappers and Real Case Use of Email Addresses

Billionaire companies such as Google for sure have spam trappers working in the background, they either implanted them on their services or most obviously, they have filtering method on their mail services like gmail. So if a spammer was to send the same exact mails to many emails from many different emails, the email content would get marked as a spam. If that makes sense, on gmail, a single email is allowed to send around 500 mails a day, and you'd want to send 10 thousand mails, you either wait 20 days, or you use 20 different accounts to send 500 mails from each. Second option is more suspicious, and your mail content will go to spam. As a spammer, what you would want to do is change the contents that are being sent from each mail, by either adding extra text, images, html etc... As a note: from a spammer's viewpoint, using non famous domains to send spams will have higher chance to get trapped into filters, that is why current botnets like Emotet are using real people mail addresses from outlook.

Also, the mail addresses that the mails are being sent from could be not trustworhy, as in not white-listed yet. If it is a new email the google has confronted, they will put it to suspicious list. If the email has been used for many many years, and has many subscriptions from youtube, quora, twitter etc, google will know it is being used by a real person and will most and most likely not set the mails sent by that address to spam, unless receivers mark you as spam or your content is bad content. So the emails should be clean too. Otherwise they will end up in spam folder where most users avoid looking.

Next is database leaks, SQL injections

As a business owner, your emails are in your database, and if your database are leaked, you would be giving away all emails to hackers for spamming as well. And these are the most important emails, because these literally what make up your business, who are all your clients. You wouldn't be keeping fake emails in your database like those poisoner are generating on the page, even if you did, that'd be to some limit. (Which it could be an idea I thought about.) Make sure to keep your database as safe as possible, do not let any SQL injections or some sort, and do not give away your emails. The spammers in modern days, which I mean in 2023, mostly will target specific businesses instead of using scrapers. They either use the technique I told you above, or they try to get data from servers or databases. So yes, email scraping is still a thing depending on its efficiency, and efficiency will most likely come from having specific targets due to many filters, and spamholes.

Make sure your servers are protected. Rest is Google's or Microsoft's job to decide if an incoming mail is spam or not. Or whatever mail service you are using, make sure they have good spam filters too. You will most likely be protected. And my program above hopefully tells you so many things, I could easily get mails like that, so get everyone in your company protected.

Answer 6

I have been running a website with a plain mailto: e-mail contact link on the footer of every page for more than 7 years. It was included in Alexa Top1M, it's been indexed by major news outlets and it has hundreds of thousand of unique views. It gets a ton of attacks. It gets a ton of abuse. It gets a ton of form spam. What it doesn't get is e-mail spam to that domain that's listed on every page. In 2022 I have received about 40 unsolicited messages, and most of them were not even directed to me. Over a half were actually mailer daemon notifications when somebody tried to spoof my e-mail address, or receipts from contact forms where they spammed somebody else using my e-mail address.

So based on personal experience I can say that no, e-mail scraping is no longer a thing for spammers.

In general, web changes fast. Most of the attack vectors you'd read about 10 years ago are all but irrelevant nowadays. With the barrier of entry to cybercrime being made extremely low, if a new attack method is discovered, it quickly gets saturated by a lot of unsophisticated threat actors and rendered ineffective in a short period of time.

Answer 7

I work for an email delivery service and we use our own subdomain to fill in missing message-id headers.The subdomain is only ever used for message-id headers not for email mailboxes or source addresses.

That subdomain gets lots of spam addressed to message-ids, so yes scraping is still a thing, and it's done badly. for MX we list a selection of spam-trap providers and one system that picks up a sample of the traffic.

Answer 8

Scraping did not fell out of favour entirely. Combined efforts just made it so spammers now need to succeed in additional steps besides just scraping public data. Collecting addresses and sending undirected garbage right away is simply no longer the most efficient way of advancing criminal plans.

First, addresses which were only published to gather information on spam campaigns (honey pots) do hinder their effectiveness drastically, so spammers try to filter and cross-check with other sources. Few humans visiting my website sees the interesting css classes attached to the tag where one of my mailboxes is published, but scraping tools evidently do and assume its a trap.

Then, because of the massive centralization it has in general become less worthwhile to send basically the same message to a large number of recipients - Google can recognize almost-copies quite well these days. So what spammers will do is wait until the address they scraped somewhere ([email protected]) is matched in some other database. That could be a template of how a message sent by that domain would look like (e.g. the greeting and signature from [email protected]) and only then they generate custom messages to the other mailboxes in that domain. With this extra step, the "does this look similar?" approaches of detecting mass spam become less effective, because the message does look similar - similar to known-good traffic exchanged with that domain.

Other sources include (automatically) browsing through compromised databases and email accounts (or backups thereof). Wordpress and Exchange components are so widely deployed and frequently affected by total-compromise security problems, specialised software specifically to search through unauthorized access to these exist and produces much higher quality datasets than just browsing public websites. In a way that is just a more advanced version of older scraping approaches.