Although a lot of advertising is the result of sold email lists, most genuine spam is probably not. Spam is spam is spam. People don't get rich off of spam and the people stupid enough to respond to spam are not the kind of people intelligent enough to purchase security systems, use products like Quicken, etc. For a spammer to invest the kind of money necessary to buy a high-end mailing list would be the height of stupidity.
So where then do these spammers get their mailing lists?
1. From people who register at "free" sites such as porn sites, various fly-by-night sites catering to various "special" interests that range from slightly akilter to totally off the map. People who visit these "extreme" sites are much more likely to be succeptible to the blandishments of email offers that would raises the hairs of most totally sane people. So the next time you visit a site that offers a cure for back pains and the cure is based on your astrological chart and various crystal auras determined by your birthdate, you can be almost certain that all that data will be funnelled to a number of spammers who will immediately add you to their target list.
2. Related to 1 above is joining or posting at various forums for the kinds of activities mentioned in 1. If any data related to you is available through the forum posts, there is probably someone harvesting that information to pass on to spammers or use for their own spam.
3. Of greater technical difficulty, but not that difficult, are email address harvesters - computer apps that essentially wander the internet and collect random addresses as they come to them. These addresses are great if you don't care who you're spamming, but they require servers or equipment capable of storing millions of items and directing email at them. Since the addresses usually come without any user data (first name, last name, age, etc), the spam can't really be personalized so it is pretty obvious that it is spam. Still, done right, with good images from Wells Fargo, it can appear valid to anyone who actually has a Wells Fargo account; so it can pay off to the spammer.
4. And then there is the name generator. Write a piece of software (it can be done in less than half an hour) that creates random sequential names (aaaaa@aol.com, aaaab@aol.com, aaaac@aol.com, etc) and send them off with a link in the body of the email that the user is supposed to click if he or she doesn't want any more email. Of course, anyone who clicks the link validates that the email address is a working one with an active user; and the name ends up on a working email list. Assuming the spammer cares, they can also delete any addresses rejected by MAILER-DAEMON. Not to do so would result in the spammer getting spammed by return email (although they can simply use their own filters to block such email).
5. Not quite finally, you can be sure that spam lists are shared between some spammers who don't see each other as competitors. This accounts for the rapid escalation in spam that a lot of us experience. Once an address is established as valid (at least to the extent that it doesn't get bounced back by MAILER-DAEMON, then it takes on its own life.
6. And, as Flop mentions in the post that follows, there is also the danger of hackers getting addresses from legitimate businesses (shows I can't think of everything).
So that's it in a nutshell. As it has so often been put: SPAM HAPPENS!
Message Edited by mijcar on 10-19-2009 10:58 AM
