First, I would like to emphasize that the content of this article has a solely informational purpose. I do not encourage anyone to do this at all. Nah, just kidding. 😀
Keep in mind that this guide is designed to find someone’s PROFESSIONAL email, not personal email. Why am I specifying that? Because it’s fucking hardcore to find someone’s personal email without going black hat, working for the NSA or being Johnny Long (or all of them at once :p).
Step 1: Identify your target’s company
That part is rather easy. You can basically check for their name on popular professional networks: linkedin.com, viadeo.com, xing.com, etc. Obviously, it depends on where your target lives and works; so, someone who’s not German may not be on xing.com. You got the idea. And if it’s not sufficient, you can probably just google their name and find out for which company they work.
Say that you want to find Arianna Huffington’s company. You’ll look her up on LinkedIn, and you’ll find that she works at the Huffington Post Media Group. We can fairly assume from that that she has a Huffington Post email. 😛
Step 2a: Identify the company’s email patterns
During this step, you must discover the patterns used by your target’s company when they create emails for their employees. There is a good dozen common patterns for creating emails, so it’s likely that your guesses will be complete shit. Now, it really depends on whether that’s a big-ass company, or a small/medium-sized company.
Case 1: the big-ass company
The big-ass company may have multiple email patterns depending on many things, such as its tiers of employees, its various departments, etc. The good thing is that there arefree web-services that let you find this kind of company’s email patterns. For example, you can use something like emailhunter.co to do just that.
Let’s take the example of IBM. IBM is a big-ass company and you can expect them to have various patterns. However, as you can see below, the most common pattern is [email protected] Concretely speaking, it means that if you target’s name is John Doe, you can assume that his email at IBM might be [email protected]
Case 2: small/medium-sized companies
Now, we had it easy with big-ass companies. But how are we going to proceed for small companies? How do you find Jane Doe’s professional email if she works at the local bakery?
Let’s take the example of Magnolia Bakery in New-York City. That’s a small and sweet company with a regular website. The great thing is that you can STILL use stuff likeemailhunter.co in that particular case as you can see below. How is that?
Basically, emailhunter.co will parse the web and find sources and weight the number of sources vs. each email pattern. Once they see that the number of sources for a specific pattern greatly outweighs other patterns, they’ll tell you that it’s likely the most common pattern. Here, [email protected]
PS: Because you don’t have too much time to waste parsing the web and weighting on sources vs. email patterns, it’s obviously faster to use already existing services.
Step 2b: You couldn’t find the company’s email patterns
Now, imagine that you ran emailhunter.co (or something similar) and definitely couldn’t find anything at all. You have no freaking idea what the target’s company email pattern could be. How would you proceed, then?
That’s when you have to do the math! Well, combinatorics, to be more specific! 😀 Because some ways of writing emails are forbidden, it also means that you can use a magic tool to infer an email’s possible forms: the syntax. You cannot use kryptonian symbols as separators in your email address!
Rob Ousbey from distilled.net created a very sweet Email Permutator that uses the idea of combinatorics + syntax and apply them in a spreadsheet. Basically, you just have to fill the stuff in yellow to get each possibility.
Once you’ve done that, you will have a big list of all possible emails that you target may have.
Step 3: Verify your target’s potential emails
So, at this stage, we most definitely found the target’s company and potentially thecompany’s email patterns.
What do we do, now? We want to verify the potential emails! We want to see if that’s indeed the target’s email before we send anything. That will avoid waiting for days or weeks at a reply that’ll never happen (not that it will happen for sure even if you have the correct email :P).
A first way to do that is to use one of the many free available web-services to check if the email is at least valid. Once again, emailhunter.co has our back covered with anemail checking tool just for that. As you can see below, it will check for various criteria, such as if the email format is valid, the MX records on the domain, if the mail server is running, etc. Basically, you can know within seconds if the email is invalid. Though, it doesn’t really tell you if it’s valid, per se.
That’s where we can step up our game a little bit! There is a very, very cool Chrome plugin just to do that that’s called Rapportive (thanks to Rob Ousbey for that tip, once again). It will basically let you cross-reference LinkedIn data and Gmail data. Shortly put, you’ll be able to know if an email is associated with a LinkedIn account, somehow, and therefore if the email is valid.
And do you remember this big list we had of all the possible emails we generated from the permutator? That’s exactly where we can use it. We can check, one possibility at a time, if it rings a bell to Rapportive and Gmail/LinkedIn data. Once of the possibilities works, then, bingo! We’ve got our email.
You can copy and paste your whole list in the email address section and go over them with your mouse to see if any of them actually works out with Rapportive. Also, even if Rapportive didn’t work that much, seeing a blue name basically means that someone’s using that email (probably our target).
Conclusion: what we’ve learned, so far
We’ve seen that to find something such as a professional email, you have to gather intelligence and cross-reference what you’ve found to form a meaningful puzzle. The puzzle was your target’s email, and you tried to get the full picture, step by step.
And speaking of steps, let’s do a quick summary:
- Step 1: You find your target’s company
- Step 2: You find the company’s email patterns
- Step 3: You verify potential emails for validity and usage
I hope that you will have a lot of fun trying to find someone’s professional email.
See you soon,
PS: you can get $10 deals for all of my courses on samymkacher.com