Email scraping collects addresses from public websites or exposed lists so they can later be reused for unsolicited contact.
The collection itself is the topic, whether or not the later message is criminal, and it feeds spam, fraud, and harassment.
How it works
Addresses published in plain form on pages, documents, or old leaks are gathered at a pace people cannot match by hand.
The organization then sees unsolicited mail, credential reuse attempts, or targeted stories that quote details the recipient never shared with that sender.
Defense reduces how many addresses are exposed, slows automated collection, and gives people a way to report a surge of unwanted contact.
This page does not describe tools or page patterns that make collection easier.
Concrete examples
- A staff directory published as plain text becomes the seed for a week of lookalike invoices.
- An old conference list appears in a leak, and attendees receive mail that quotes the event name.
- A contact form is submitted thousands of times by automation that is harvesting nothing but also proving the form has no friction.
Protective measures
- Avoid publishing personal mail addresses in plain page text when a form or a role address will do.
- Put meaningful friction on public forms so automated collection and junk submission are more expensive.
- Watch for sudden harvesting of pages that list people, and remove or gate those pages when they are abused.
- Tell staff how to report a surge of unsolicited mail that uses their work address.
Related articles
Filters that meet the unwanted mail after addresses have been collected are explained in What is email protection?.
Junk submitted through public forms, a close cousin of automated collection, is the subject of What is form spam?.
Publishing personal addresses without a purpose conflicts with the duties in What is data privacy?.