From IRC

Some IRC clients will give a user's email address to anyone who cares to ask it. Many spammers harvest email addresses from IRC, knowing that those are 'live' addresses and send spam to those email addresses.

This method is used beside the annoying IRCbots that send messages interactively to IRC and chat rooms without attempting to recognize who is participating in the first place.

This is another major source of email addresses for spammers, especially as this is one of the first public activities newbies join, making it easy for spammers to harvest 'fresh' addresses of people who might have very little experience dealing with spam.

From chat rooms

Chat rooms are notorious for email spam. AOL chat rooms are the most popular of those - according to reports there's a utility that can get the screen names of participants in AOL chat rooms. The utility is reported to be specialized for AOL due to two main reasons - AOL makes the list of the actively participating users' screen names available and AOL users are considered prime targets by spammers due to the reputation of AOL as being the ISP of choice by newbies.

Microsoft's instant messenger uses an email address rather than a screen name - not good.

From finger daemons

Some finger daemons are set to be very friendly - a finger query asking for john@mydomain will produce list info including login names for all people named John on that host. A query for @mydomain will produce a list of all currently logged-on users.

Spammers use this information to get extensive users list from hosts, and of active accounts - ones which are 'live' and will read their mail soon enough to be really attractive spam targets.

AOL profiles

Spammers harvest AOL names from user profiles lists, as it allows them to 'target' their mailing lists. Also, AOL has a name being the choice ISP of newbies, who might not know how to recognize scams or know how to handle spam.

From catchall accounts

Many hosts allow catchall accounts: an email address that invalid email addresses of a domain are redirected. For example, if abc@mydomain.com is the catchall email, then *any* email sent to mydomain.com will work (such as zzbottom@mydomain.com will work even if it is not a valid email address).

Some web hosts are disallowing catchall accounts for this reason.

From domain contact points

Every domain has one to three contact points - administration, technical, and billing. The contact point includes the email address of the contact person.

As the contact points are freely available, e.g. using the 'whois' command, spammers harvest the email addresses from the contact points for lists of domains (the list of domain is usually made available to the public by the domain registries). This is a tempting methods for spammers, as those email addresses are most usually valid and mail sent to it is being read regularly.

By guessing & cleaning

Some spammers guess email addresses, send a test message (or a real spam) to a list which includes the guessed addresses (such as test, info, webmaster). Then they wait for either an error message to return by email, indicating that the email address is correct, or for a confirmation. A confirmation could be solicited by inserting non-standard but commonly used mail headers requesting that the delivery system and/or mail client send a confirmation of delivery or reading. No news are, of course, good news for the spammer.

Specifically, the headers are -
 Return-Receipt-To: <email-address> which causes a delivery confirmation to be sent, and
 X-Confirm-Reading-To: <email-address> which causes a reading confirmation to be sent.

Another method of confirming valid email addresses is sending HTML in the email's body (that is sending a web page as the email's content), and embedding in the HTML an image. Mail clients that decode HTML, e.g. as Outlook and Eudora do in the preview pane, will attempt fetching the image - and some spammers put the recipient's email address in the image's URL, and check the web server's log for the email addresses of recipients who viewed the spam.

So it's good advice to set the mail client to *not* preview rich media emails, which would protect the recipient from both accidently confirming their email addresses to spammers and viruses.

Guessing could be done based on the fact that email addresses are based on people's names, usually in commonly used ways (first.last@domain or an initial of one name followed / preceded by the other @domain)

Also, some email addresses are standard - postmaster is mandated by the RFCs for internet mail. Other common email addresses are postmaster, hostmaster, root [for unix hosts], etc.

From online white & yellow pages

There are various sites that serve as white pages, sometimes named people finders web sites. Yellow pages now have an email directory on the web.

Those white/yellow pages contain addresses from various sources, e.g. from UseNet, but sometimes your E-mail address will be registered for you. Example - HotMail will add E-mail addresses to BigFoot by default, making new addresses available to the public.

Spammers go through those directories in order to get email addresses. Most directories prohibit email address harvesting by spammers, but as those databases have a large databases of email addresses + names, it's a tempting target for spammers.

By having access to the same computer

If a spammer has an access to a computer, he can usually get a list of valid usernames (and therefore email addresses) on that computer.

On unix computers the users file (/etc/passwd) is commonly world readable, and the list of currently logged-in users is listed via the 'who' command.

From a previous owner of the email address

An email address might have been owned by someone else, who disposed of it. This might happen with dialup usernames at ISPs - somebody signs up for an ISP, has his/her email address harvested by spammers, and cancel the account. When somebody else signs up with the same ISP with the same username, spammers already know of it.

Similar things can happen with AOL screen names - somebody uses a screen name, gets tired of it, releases it. Later on somebody else might take the same screen name.

Using social engineering

This method means the spammer uses a hoax to convince people into giving him valid email addresses.

From the address book and emails on other people's computers

Some viruses & worms spread by emailing themselves to all the email addresses they can find in the email address book. As some people forward jokes and other material by email to their friends, putting their friends' email addresses on either the To: or Cc: fields, rather than the BCc: field, some viruses and warms scan the mail folders for email addresses that are not in the address book, in hope to hit addresses the computer owner's friends' friends, friends' friends' friends, etc.

If it wasn't already done, it's just a matter of time before such malware will not only spam copies of itself, but also send the extracted list of email addresses to it's creator.

As invisible email addresses can't be harvested, it's good advice to have the email addresses of recipients of jokes & the like on BCC:, and if forwarded from somebody else remove from the email's body all the email addresses inserted by the previous sender.

Buying lists from others

This one covers two types of trades. The first type consists of buying a list of email addresses (often on CD) that were harvested via other methods, e.g. someone harvesting email addresses from UseNet and sells the list either to a company that wishes to advertise via email (sometimes passing off the list as that of people who opted-in for emailed advertisements) or to others who resell the list.

The second type consists of a company who got the email addresses legitimately (e.g. a magazine that asks subscribers for their email in order to keep in touch over the Internet) and sells the list for the extra income. This extends to selling of email addresses a company got via other means, e.g. people who just emailed the company with inquiries in any context.

The third type consist of technical staff selling the email address for money to spammers.

By hacking into sites

I've heard rumors that sites that supply free email addresses were hacked in order to get the list of email addresses, somewhat like e-commerce sites being hacked to get a list of credit cards.