🛡️ SPAM: How to Trace Where Scammers Got Your Address

Nov '25 (edited) • Pro Tips

Scam emails aren’t random. The recipient fields already tell you a lot.

📥 TO, CC & BCC Explained

TO: You’re the main target

Your email is openly listed. They contacted you directly.

CC: Everyone can see each other

If strangers are CC’d, it’s a bulk blast from a scraped or leaked list.

BCC: You don’t appear anywhere

You’ll receive the email, but your address won’t show in To/CC.

Classic sign of mass phishing campaigns.

If you see “To: (empty)” or the sender’s own address → you were BCC’d.

🔍 How to Track Where Your Email Leaked

✔ Plus Addressing

Use aliases like:

name+amazon@…

name+instagram@…

If spam arrives on that alias → you know exactly who leaked or sold it.

✔ Have I Been Pwned

Check if your email appeared in a breach.

Turn on notifications so you get alerts immediately.

✔ Email Headers (advanced) or click: “<> Show original” in the menu with the three dots if you use G Mail.

Look at return path, server, and SPF/DKIM/DMARC.

If it doesn’t match the claimed sender → scam.

We’ll take a deep dive into this in an advanced E-mail course.

What can you do moving forward?

🛡️ Protect Your Inbox

10 comments

skool.com/huisvestnl-3698

Get started in OSINT and learn how to find out about anything and anyone online, professionally.

Bring people together around your passion and get paid.