How do spammers harvest email addresses?

Web scraping extracts addresses from public pages: websites, forums, social media, and directories. Automated tools crawl the internet collecting addresses exposed in public content.

Data breaches provide massive address lists. Compromised databases are sold or shared in criminal markets. Breach-sourced lists include addresses never publicly exposed.

Other methods: purchasing lists from unethical providers, dictionary attacks (guessing common addresses), and **malware** harvesting from infected machines. Addresses in spam lists often came through multiple paths.