The Art of Finding Anyone’s Email Addresses

#1

Post by LifeAfterCubes » Sat, May 25, 2013, 2:22 PM UTC

The Art of Finding Anyone’s Email Addresses
lifeaftercubes.com

Re: The Art of Finding Anyone’s Email Addresses

#2

Post by [deleted] » Sat, May 25, 2013, 5:11 PM UTC

[deleted]

Re: The Art of Finding Anyone’s Email Addresses

#3

Post by abuiles » Sat, May 25, 2013, 5:38 PM UTC

I wanted to contact people from some companies but their email was not in their profiles, I found this script in github https://github.com/laramies/theHarvester which looks for emails given a domain.

Is super useful, even though It wouldn't give me the email I was looking for, it would show me the "structure" used for emails inside the company:

   first_name@domain.com
   first_name.last_name@domain.com

Based on that I would just guest the email of the person and it used to work perfectly.

This is perfect for doing customer development, also if you are doing cold reach outs remember to follow the CAN-SPAM act.

Re: The Art of Finding Anyone’s Email Addresses

#4

Post by jimmythegent » Sat, May 25, 2013, 5:52 PM UTC

There is a catch-all address at my company that goes to our CEO. He forwards me headhunter emails all the time that are addressed to variations of my first and last name. :-/

I'm assuming they used similar tactics to try to find my address

Re: The Art of Finding Anyone’s Email Addresses

#5

Post by ternaryoperator » Sat, May 25, 2013, 6:03 PM UTC

jimmythegent wrote: post #4

There is a catch-all address at my company that goes to our CEO. He forwards me headhunter emails all the time that are addressed to variations of my first and last name. :-/ I'm assuming they used similar tactics to try to find my address

> He forwards me headhunter emails all the time that are addressed to variations of my first and last name.

Sure he's not trying to tell you something? :-|

Re: The Art of Finding Anyone’s Email Addresses

#6

Post by clarkm » Sat, May 25, 2013, 6:11 PM UTC

abuiles wrote: post #3

I wanted to contact people from some companies but their email was not in their profiles, I found this script in github https://github.com/laramies/theHarvester which looks for emails given a domain. Is super useful, even though It wouldn't give me the email I was looking for, it would show me the "structure" used for emails inside the company: first_name@domain.com first_name.last_name@domain.com Based on that I wou…

If I ever get into a situation where I can't figure out the address, I just pick one of my guesses and bcc all the rest.

Sure, they might think it's a little weird if they notice they're in the bcc field, but it sure is a lot easier than sending off a single email and spending the next few days wondering if it actually went through.

Re: The Art of Finding Anyone’s Email Addresses

#7

Post by mindprince » Sat, May 25, 2013, 6:20 PM UTC

To verify if you have guessed someone's correct gmail address you can always do this - http://mindprince.blogspot.com/2012/12/google-plus-profile-g... Works for all those who have upgraded to Google+.

Re: The Art of Finding Anyone’s Email Addresses

#8

Post by madsushi » Sat, May 25, 2013, 6:32 PM UTC

I hadn't heard of MailTester before; I have used the telnet/25 and RCPT TO: technique manually several times.

Re: The Art of Finding Anyone’s Email Addresses

#9

Post by danso » Sat, May 25, 2013, 6:45 PM UTC

This is a Hail Mary, but I've found some important email address by running a WHOIS on that person's known web properties. While he may have hidden his registration info for his personal site, he may have slipped up on his project sites

Re: The Art of Finding Anyone’s Email Addresses

#10

Post by msumpter » Sat, May 25, 2013, 7:06 PM UTC

danso wrote: post #9

This is a Hail Mary, but I've found some important email address by running a WHOIS on that person's known web properties. While he may have hidden his registration info for his personal site, he may have slipped up on his project sites

You can also use tools like DomainTools.com to look at historical registration data, their data may be private now but could have been exposed previously.