Find Anyone’s Business Email Address using OSINT

Find Anyone’s Business Email Address using OSINT
Find Anyone’s Business Email Address using OSINT
Find Anyone’s Business Email Address using OSINT
Find Anyone’s Business Email Address using OSINT
Find Anyone’s Business Email Address using OSINT

Almost everyone who works in a company has a business email address that they use to contact clients, send B2B emails, increase brand awareness, build trust, etc…

In this article, I would like to share ways to find someone’s business email address or a company employee’s email address.

In my opinion, finding a business email address is much easier than finding someone’s personal email address because a business email always follows a pattern, unlike a personal email which may consist of a first, and last name, year of birth, favorite car, or city, etc…

Also Read: Search for Someone’s Personal Email Address using OSINT

Why it’s important to get business email addresses

Imagine a company hired you to perform a phishing attack against its employees to increase and test its employee’s security awareness

OR

You want to apply for a job in a company, but you want to send your resume directly to the CEO instead of sending it to human resources.

In both cases, you need to find the employees’ email addresses either got hired or to run a phishing campaign.

Identifying the Email Pattern

The first thing I would like to do to find the employees email addresses is to identify the email pattern the company uses.

An email pattern could be something like this:

  1. {f}.{last}@companydomain.* – (j.doe@companydomain.*)
  2. {first}.{l}@companydomain.* – (john.d@companydomain.*)
  3. {f}.{l}@companydomain.* – (j.d@companydomain.*)
  4. {first}.{last}@companydomain.* – (john.doe@companydomain.*)

If you were able to find one email address of an employee in a company, you’ll be able to guess all the employees’ email addresses because they all follow the same pattern.

Browser Extensions

There are some extensions that you can use right away on your browser to find someone’s email address. I find this to be one of the quickest ways to find someone’s email address.

Contact Out

The first extension is called Contact Out. Contact Out use crawlers that scan the internet looking for emails and phone numbers.

The cool thing about Contact Out is that it’s FREE. You are allowed to search for up to 40 emails a month for Free!

If you want to search for more than 40 email addresses, then you have to have a monthly/yearly subscription.

This extension only works with LinkedIn accounts. This means if your target doesn’t have a LinkedIn account, then this extension is useless.

Find Business Email with ContactOut
Find Business Email with ContactOut

GetProspect

Another cool and FREE extension for Chrome is GetProspect.

“GetProspect LinkedIn email extractor visits the targeted profiles on LinkedIn and extracts the data from them: name, location, company details, summary. Based on the extracted company domain and company email pattern, GetProspect finds and verifies the email address”

source: https://getprospect.com/linkedIn-email-finder-chrome-extension

GetProspect is not as powerful as Contact Out since it only shows you the current email the target use, unlike Contact Out which shows you all previous emails the target used with his/her LinkedIn account.

Again, this extension only works with LinkedIn accounts.

Find Business Email with GetProspect
Find Business Email with GetProspect

SignalHire

I would consider SignalHire is one of the most powerful browser extensions to find someone’s email address. It supports both Firefox and Chrome, and it works on LinkedIn, Facebook, GitHub, Twitter, and MeetUp.

You can find anyone’s data only by name, position or location. The only issue though is that it’s a paid extension. The only free thing you can use is their Find the Lead feature that allows you to search for someone’s LinkedIn profile by email.

Find LinkedIn profile with SignalHire
Find a LinkedIn profile with SignalHire

Clearbit

Finally, Clearbit is another FREE browser extension that allows you to find employees’ business email addresses. The cool thing about this extension is that you don’t need to have a LinkedIn account to see the employees’ email addresses. Please keep in mind that Clearbit works only with Gmail.

Find Business Email with Clearbit
Find Business Email with Clearbit

OSINT Links

Links to the websites are in CyberSudo’s OSINT Toolkit.

Get a Free Ethical Hacking Kit: https://bit.ly/438k4nS

  1. CyberSudo’s OSINT Toolkit
  2. 25% OSINT Masterclass Discount
  3. Hacking Radio Frequency mini-course
  4. Hacking Wi-Fi on OSX mini-course

OSINT Playlist https://bit.ly/3U3hoV0

Saad Sarraj

I am a CyberSecurity and Ethical Hacking/Penetration Testing passionate. I am also a TryHackMe Top 1% CTF Player.

Leave a Reply

Your email address will not be published. Required fields are marked *