TL;DR: Your address reaches spammers through four main doors: sites that share it, bots that scrape it, breaches that leak it, and brokers that sell it. Close those doors by giving one-time sites a burner address instead.

The moment you press submit

Ever wonder how one harmless sign-up turns into fifty new senders? Often the site you trusted did exactly what its fine print said it would. Buried in the terms is a line about sharing your details with "select partners" or "trusted third parties." You gave one company your address; the paperwork let a dozen more borrow it.

Sweepstakes, free-trial offers, and "spin the wheel" discount games are the biggest funnels. Some of them exist mostly to collect addresses, and the prize is the bait. Pre-checked boxes do quiet damage too - That tiny "yes, send me offers from partners" checkbox was already ticked when the page loaded, and most people never scroll down far enough to untick it.

Bots that read the public web

Harvesting bots crawl the internet around the clock, hunting for anything shaped like an email address. They read forum posts, blog comments, club rosters, "contact me" pages, and old PDFs nobody remembers uploading. If your address sits anywhere public, assume a bot has already copied it.

People try tricks like writing "john at example dot com," and the simplest bots do miss that. The better ones don't - They've been trained on every disguise in the book. The only spelling a scraper can't harvest is one that isn't posted. When something public needs a contact address, post one you're willing to sacrifice, not the one your bank uses.

Breaches spill everything at once

Even careful people get caught here. You can untick every box and post nothing publicly, and still end up on a list because a company you signed up with got hacked. One breach at one mid-sized website can spill millions of addresses in a single night, often bundled with names and passwords.

Those files don't stay secret. They get traded, merged with other leaks, and repackaged into giant combo lists that circulate for years. An address that leaked once is effectively public forever - There's no recall button. This is the strongest argument for limiting how many databases hold your real address in the first place: each one is a bet on that company's security team.

The quiet market for lists

Then there's the legal-ish middle ground: the list trade. Data brokers buy, rent, and swap mailing lists the way collectors trade cards. A list of "10,000 confirmed shoppers interested in fitness" has a price tag, and your address might be one of the line items.

Brokers also run a matching game called appending - Connecting an address from one database to your name, location, and shopping history from another. Every append makes the file on you thicker and the list you're on more valuable. The economics only break when the address on the list stops working, which is exactly what a self-destructing address does by design.

Signs your address is circulating

How do you know you're on the lists? The clues pile up:

  • Spam that greets you by name, or references a real purchase
  • Waves of similar junk arriving in clusters over a few days
  • Mail from companies in an industry you recently asked for quotes in
  • Messages to an address you only ever gave to one site

That last one is worth engineering on purpose. Give each new site a different address and you'll know exactly who leaked or sold you out - No guessing required.

Closing the doors

You can't un-leak an address, but you can stop feeding the machine. Untick the partner boxes. Keep your real address off public pages. And for every site you don't fully trust - Which should be most new ones - Hand over a temporary email that expires in ten minutes instead. A harvested burner address is worthless: by the time any list is compiled, sold, and mailed, the inbox is gone. The spam protection guide shows how to set that up, and once your address is out there less, the next thing to control is what senders learn when you open their mail - That's the subject of our tracking pixels guide.