Email (and postal mail) are the only mainstream channels left for which you can send a message to anyone without being blocked by a tech giant. So then, the question begets – how do you get the email address of any individual? There are tons of articles out there, but there exists no comprehensive tutorial for the rest of us. In this article, I will lay out step-by-step how you can get anyone's email.
As the CEO of Enrich Layer, we provide a service known as Enrich Layer, which provides a service to help businesses build better products with data.
I am a privacy cynic, and I have built Gom VPN service in my earlier years, which more than 1M users have since used. I am also a software engineer professionally. So I know the internet pretty well.
Given the inclination both professionally and personally, I am always on the lookout for new ways that data can connect people found publicly on the internet. I do know quite a bit about surfacing publicly available data about people. Please don't take my word on it; try out the methods found in this article and judge it for yourself.
There are two types of email addresses—personal and work emails. Personal emails are email addresses often hosted by free email providers such as Gmail, Hotmail, or Yahoo. Users often use these email addresses to register themselves on social media or shopping sites like Amazon, Steam, forums, Facebook, Instagram, or TikTok.
Personal email addresses are as visible as your phone number. That is to say; people will only know your personal email address when you:
It is slightly harder to get personal email addresses, but it can be done. This is how we shall start:
Identity on the internet is very much tied to a social media profile. I am going to assume that you have the name of your target. Now, we have to resolve this name into identity on social media accounts. In order of efficiency, I recommend you search for the profile of your target on these social media networks (the higher, the better your success rate is):
Once you have the profiles, follow the table below to get to the actual method:
What you haveMethodNotes
A person's name Find the person's social media profile This method is a precursor step which leads to an actual email extraction method
A person's name Find emails from Facebook's Data Leak (Method B) Bonus: You have a higher chance of getting the user's phone number with this method
professional networks Profile
Twitter Profile Find emails via Twitter's history (Method C)
Forum Username Find emails via Bing search (Method D)
In 2019, 416 million people had their phone numbers and personal email addresses leaked by People Data Labs (PDL). PDL is in the business of gathering personal information of people worldwide from all kinds of sources. So if you live in a western country with a significant internet presence, there is a good chance that your personal information is exposed in this leak.
This method requires a professional networks Profile URL.
Search the internet for PDL's data leak. Download the leak. It should be a .7z (7zip) file of around 9+GB. (I seek your understanding in that I am not able to provide a guide as to how you can get this leak.)
Unpack the 7-zip file from the tools at 7-zip.org
Install Windows Subsystem for Linux if you are using Windows. If you use Linux or Mac, you are fine.
Open a bash terminal
\$ cd \<PATH_TO_UNPACKED_DATA_FOLDER\>
\$ grep -a -m 1 -h -r "https://www.professionalsocialnetwork.com/in/mayra-martínez-soto-271a74a3" file.json | head -1
where https://www.professionalsocialnetwork.com/in/mayra-martínez-soto-271a74a3 is the professional networks Profile URL.The last command will take some time to run. This is what it will return
\{ "a": "humble, texas, united states", "t": [ "\<CENSORED\>", "\<CENSORED\>" ], "e": [ "\<CENSORED\>@yahoo.com", "\<CENSORED\>@gmail.com" ], "liid": "billy-mckay-64217246", "the platform": "https://www.professionalsocialnetwork.com/in/billy-mckay-64217246", "n": "billy mckay" \}
There, emails found. The email addresses you are seeking are under e key.
Just this year (2021), a dataset involving 533 million users on Facebook leaked. Unlike the People Data Labs leak, this leak involves personal phone numbers rather than email addresses. However, in my quick analysis, 7% of the leaked profiles do have email addresses. So if you have the Facebook profile ID of your target, this method might work.
This method requires a Facebook Profile ID.
Search the internet for Facebook's data leak. The leaks are segregated by countries. Download the leak corresponding to the country of your target. It should be a .zip (zip) file. (I seek your understanding in that I am not able to provide a guide as to how you can get this leak.)
Unpack the zip file and you will get a .csv file
Install WIndows Subsystem for Linux if you are using Windows. If you use Linux or Mac, you are fine.
Visit the Facebook Profile, and get the first and last name of the person in the profile. For example, Siew Weng is the first name, Seetoh is the last name.
Open a bash terminal
\$ cd \<PATH_TO_UNPACKED_DATA_FOLDER\>
\$ grep -a -m 1 -h -r "Siew Weng,Seetoh" file.json | head -1
where Siew Weng is the first name of the target, and Seetoh is the last name of the target.The last command will take some time to run. This is what it will return
6598999978,100009308285955,Siew Weng,Seetoh,male,,,,,,[email protected],
There, the [email protected] email address is found. (We censored the actual email).
Using advanced operators in a Google search, you can search a Twitter account history for occurrences for which he/she might have shared his email address publicly.
This method requires a Twitter ID.
inurl:twitter.com/Enrich Layer email; where Enrich Layer is the Twitter account you want to search.
I used my profile, and immediately, you can see that an email address ([email protected]) was found. Google search has a result for which I revealed publicly on Twitter that I'm contactable at an old email address.
People often divulge their contact information on public forums. As with Method C, you can find email addresses with a good search phrase with operators. In this method, we use Bing because their results are more precise compared to Google.
This method requires a domain of a forum and a username.
Weijia is the username and forums.hardwarezone.com.sg is the domain of the forum)`:site:forums.hardwarezone.com.sg "@gmail.com" "Weijia"
site:forums.hardwarezone.com.sg "@yahoo.com" "Weijia"
site:forums.hardwarezone.com.sg "@hotmail.com" "Weijia"
site:forums.hardwarezone.com.sg "@outlook.com" "Weijia"
Just like that, the email address of said user is found to be [email protected].
As the name suggests, work email addresses are email addresses that a business assigns to employees. Unfortunately, work emails often stop working when an employee leaves because employees come and go. So work email addresses get stale after some time. Nevertheless, work email addresses are easier to extract with specialized methods.
There are two methods to get the work email addresses of people.
The first method is to use Clearbit Connect. Clearbit Connect works by stealing the email contacts of 100000+ users that are using it. It works by crowdsourcing email addresses from users, albeit in an unethical manner.
The second method uses Enrich Layer's Work Email Lookup Endpoint, which works by using publicly available data via best practices such as email permutation, web scraping, and email verification.
As much as it does sound like I'm shilling, but Enrich Layer's Work Email Lookup API works at least 3x better than Clearbit's solution. In a blog post to research Clearbit's efficacy, we found that Clearbit found 13.2% real and deliverable work email addresses. In comparison, Enrich Layer's Email Lookup API found 51.2% real and deliverable work email addresses.
Regardless of ethics, I'd recommend that you pick Enrich Layer's Work Email Lookup Endpoint simply because it works better and costs just $0.10 per search. So, for work emails, do follow this table to get to an email address.
What you have Method Notes
A person's name and company name Google This method is a precursor step which leads to an actual email extraction method
professional networks Profile URL Use Enrich Layer Email Lookup API (Method E) Costs $0.10 per request
Enrich Layer's Email Lookup works 51% of the time, based on my personal research after trying to find work email addresses of around 3000+ user profiles.
This method requires a professional networks Profile ID.
Create a free account on Enrich Layer. Once you are signed in, you will need the API key found in the dashboard. Save this somewhere.
Install WIndows Subsystem for Linux if you are using Windows. If you use Linux or Mac, you are fine.
Open a bash terminal
curl \ -X GET \ -H "Authorization: Bearer \$\{YOUR_API_KEY\}" \ platform/profile/email?the platform_profile_
Where YOUR_API_KEY is the API key found in the dashboard
and enrich-layer-team-6738131b is the professional networks Profile ID.
Wait 15 minutes as the Enrich Layer service takes some time to lookup the email address.
Run the same command again. Now, you will get the following result:
There you go, work email is found.
Most of the methods I listed are very menial, and they work well if you have one target. What if you have a million of them? The good news is that Enrich Layer's Email Lookup is made as an API, so you can programmatically integrate that into your system to automate sales. That's how we did it. And if you need help, feel free to shoot us an email at [email protected], and I will see what I can do for you
And if you love reading anecdotes as to how we are solving business problems with our data tools, click here to subscribe