Posted on

Address harvesting from public websites and directories

The cruel little trick of a public email address is that the person who needs to remain reachable also becomes easy to collect.

A professor posts an address for students. A small business lists one for customers. A developer puts one in project documentation. A volunteer organization publishes contact details so actual humans can ask questions.

A harvester sees the same page as inventory.

The Federal Trade Commission tested this directly in 2005. Staff created 150 undercover email accounts and posted addresses on public Internet locations including message boards, blogs, chat rooms, and Usenet groups. The FTC reported that spammers continued to harvest addresses from public areas of the Internet. See FTC Study Shows Technology Gaining in the Battle Against Spam.

The practice is old because the economics are obvious.

A crawler can collect addresses faster than a person can decide whether each recipient would reasonably expect the message.

Reachable does not mean subscribed

A public address communicates one thing clearly:

You may contact this person for some purpose.

It does not automatically communicate:

Add this person to an unrelated bulk campaign forever.

Intent matters.

A journalist publishing a tip address is inviting tips. A shop publishing a support address is inviting customer questions. A domain registration contact, conference speaker page, academic directory, or open-source README may expose an address for a specific practical reason.

Mass promotional reuse changes the purpose without asking the owner.

U.S. CAN-SPAM law also treats some address harvesting as especially serious. The FTC’s current compliance guide lists harvesting email addresses among aggravated violations that can trigger additional consequences when the statutory conditions are met. See the FTC CAN-SPAM compliance guide.

The defensive cost falls on the reachable person

Harvesting produces a strange penalty for openness.

People who need public contact details start disguising addresses, routing everything through forms, adding CAPTCHA, using disposable aliases, or hiding behind platform messaging systems.

That makes automated collection harder.

It can also make legitimate contact harder.

The public web loses a little interoperability because somebody decided that every visible mailbox was a lead source.

This is one of the quieter ways Spam Empires change the shape of the internet. Abuse does not merely fill inboxes.

It teaches ordinary people that being easy to reach is a liability.