We get a lot of questions about how could a spammer get your email even though you are careful or how did you get an email which seems to have been sent by you or your company but is actually spam.
Although the methods spammers use are as numerous as bad drivers on the road, I will only cover a few here, perhaps some of the less obvious.
We will take the example of John Q. Public at U. S. Marketing. Emails: johnp@usmarketing.com and jpublic@usmarketing.com
Undoubtedly, U. S. Marketing has a website, www.usmarketing.com. Since spammers can crawl the web just as search engines do, they now have access to a potential source for an email address, @usmarketing.com, since many companies use the same domain for their web site and email.
If there are any contact us pages or bios on the web site, with email addresses, the spammer now has those addresses, since the crawl program just has to look for an @ sign. The crawlers also look for @ signs anywhere on the net. Is your email in any social media blogs, business directories or almost any electronic form accessible on the web?
So, now the spammer has a domain and potentially some email addresses. But they do not need specific email addresses to send spam. They can create potential email addresses by running through many combinations and variations. How about williamp@ or johnp@ or maybe even stumble on jpublic@.
OK, so they have some emails and 1000′s of potential emails. The spammer doesn’t have to send all those emails to know which ones are valid, though they could, they can test them without actually sending an email, sort of like pinging. Bingo, now they know both johnp@usmarketing.com and jpublic@usmarketing.com are valid emails.
How do they get you to open their email? Since they know the address (they are sending to it, aren’t they?) they can add a few tricks. First, for the most part, they can make it seem like it is sent from any address or display name they want. The from address or the display names are among the easier things for them to fake. Often your own email program will add the display name from your address book. So, if they make it seem like it is to johnp@usmarketing.com from johnp@usmarketing.com Outlook, or whatever program you use, might display your full name in the inbox, even though the spammer does not know your full name.
Another trick would be to send it from info@usmarketing.com or support@usmarketing.com or any potential general account a company might have. If they chose the johnp@ as the address to send it to, then they also know your first name is John, so why not add your name to the subject, Hey John, open me. Tricky, huh?
Well those are just a few of the tricks and, having said all that, I will now help them out a little by posting this and telling everyone to go to our website at http://www.ag-is.com. Who knows, maybe they will crawl my post or a search engine will pick it up and they will crawl that link.