I've been doing this for about two decades, and I've had to block a fair few addresses for spam over that time. In almost all cases with companies of any signi

I've been doing this for about two decades, and I've had to block a fair few addresses for spam over that time. In almost all cases with companies of any significant size/reputation it was entities that either publicly admitted or were publicly called out as having been hacked – so incompetence or the bad luck rather than deliberately selling my details on. In a few of cases (a couple of hosting providers, a physical-store electronics retailer) it has been a business that had failed before the spam started, so presumably their contacts were sold as an asset as part of the winding down. I give different addresses to any online forum too — they have seen a much higher rate of addresses needing to be dropped due to spam. If you use a catch-all address rather than setting up each alias individually then you may get “dictionary” attacks at some point. Early on when I used <varies-by-company-or-other>@domain.tld I saw that a few times, with someone sending to alan@, alana@, alvin@, … Since moving over to <varies-by-company-or-other>@sub.domain.tld (where “sub” is a static sub domain operating as catch-all, with only a whitelist of addresses on the main domain now accepted) I've not seen this again. I don't know if that is because name dictionary attacks like that are simply rare, are not attempted on more complex addresses, or never really worked so spammers don't use the technique at all any more. Where an address ends in a number, I've seen guesses that increment that number – so as well as getting junk to somecompany2@sub.domain.tld I get junk to somecompany3@sub.domain.tld and so on. I assume this is an address farmer bulking out their database. One place where passing on of your email address seems rife is kickstarter and indigogo projects. I'm on several mailing lists I've never subscribed to on those addresses, and another appears every couple of months — I don't know if it is the projects themselves or the survey management third parties that are to blame, I suppose I could test that by cycling the address but I'm not been bothered enough to make that effort. I have messages from those lists auto-filed into a folder, and if I'm tempted to support a project I search that folder first – if they have been carried by one of the spammy mailing lists I won't be giving them any of my money. I've saved money on three projects thus far with this. A petty victory perhaps, but I like my petty little victories!