5 Sure Hacks To Find Anyone's Personal & Work Emails

Email (and postal mail) are the only mainstream channels left for which you can send a message to anyone without being blocked by a tech giant. So then, the question begets -- how do you get the email address of any individual? There are tons of articles out there, but there exists no comprehensive tutorial for the rest of us. In this article, I will lay out step-by-step how you can get anyone's email.

Why You Should Trust Me

As the CEO of Nubela, we provide a service known as Proxycurl, which provides a service to help businesses build better products with data.

I am a privacy cynic, and I have built Gom VPN service in my earlier years, which more than 1M users have since used. I am also a software engineer professionally. So I know the internet pretty well.

Given the inclination both professionally and personally, I am always on the lookout for new ways that data can connect people found publicly on the internet. I do know quite a bit about surfacing publicly available data about people. Please don't take my word on it; try out the methods found in this article and judge it for yourself.

Lookup Personal Emails

There are two types of email addresses—personal and work emails. Personal emails are email addresses often hosted by free email providers such as Gmail, Hotmail, or Yahoo. Users often use these email addresses to register themselves on social media or shopping sites like Amazon, Steam, forums, Facebook, Instagram, or TikTok.

Personal email addresses are as visible as your phone number. That is to say; people will only know your personal email address when you:

1. Give it out to another person
2. A major site leaked it
3. Post it on a public forum/website such as a Facebook Group

It is slightly harder to get personal email addresses, but it can be done. This is how we shall start:

First, find the target's social media profile

Identity on the internet is very much tied to a social media profile. I am going to assume that you have the name of your target. Now, we have to resolve this name into identity on social media accounts. In order of efficiency, I recommend you search for the profile of your target on these social media networks (the higher, the better your success rate is):

1. LinkedIn
2. Facebook
3. Twitter
4. Discussion Forums

Once you have the profiles, follow the table below to get to the actual method:

Method A: Find Emails From People Data Lab's Data Leak

In 2019, 416 million people had their phone numbers and personal email addresses leaked by People Data Labs (PDL). PDL is in the business of gathering personal information of people worldwide from all kinds of sources. So if you live in a western country with a significant internet presence, there is a good chance that your personal information is exposed in this leak.

This method requires a LinkedIn Profile URL.

1. Search the internet for PDL's data leak. Download the leak. It should be a .7z (7zip) file of around 9+GB. (I seek your understanding in that I am not able to provide a guide as to how you can get this leak.)

2. Unpack the 7-zip file from the tools at 7-zip.org

3. Install Windows Subsystem for Linux if you are using Windows. If you use Linux or Mac, you are fine.

4. Open a bash terminal

   1. $ cd <PATH_TO_UNPACKED_DATA_FOLDER>
      

   2. $ grep -a -m 1 -h -r "https://www.linkedin.com/in/mayra-martínez-soto-271a74a3" file.json | head -1
      

      where https://www.linkedin.com/in/mayra-martínez-soto-271a74a3 is the Linkedin Profile URL.

The last command will take some time to run. This is what it will return

{
  "a": "humble, texas, united states",
  "t": [
    "<CENSORED>",
    "<CENSORED>"
  ],
  "e": [
    "<CENSORED>@yahoo.com",
    "<CENSORED>@gmail.com"
  ],
  "liid": "billy-mckay-64217246",
  "linkedin": "https://www.linkedin.com/in/billy-mckay-64217246",
  "n": "billy mckay"
}

There, emails found. The email addresses you are seeking are under e key.

Method B: Find Emails From Facebook's Data Leak

Just this year (2021), a dataset involving 533 million users on Facebook leaked. Unlike the People Data Labs leak, this leak involves personal phone numbers rather than email addresses. However, in my quick analysis, 7% of the leaked profiles do have email addresses. So if you have the Facebook profile ID of your target, this method might work.

This method requires a Facebook Profile ID.

1. Search the internet for Facebook's data leak. The leaks are segregated by countries. Download the leak corresponding to the country of your target. It should be a .zip (zip) file. (I seek your understanding in that I am not able to provide a guide as to how you can get this leak.)

2. Unpack the zip file and you will get a .csv file

3. Install WIndows Subsystem for Linux if you are using Windows. If you use Linux or Mac, you are fine.

4. Visit the Facebook Profile, and get the first and last name of the person in the profile. For example, Siew Weng is the first name, Seetoh is the last name.

5. Open a bash terminal

   1. $ cd <PATH_TO_UNPACKED_DATA_FOLDER>
      

   2. $ grep -a -m 1 -h -r "Siew Weng,Seetoh" file.json | head -1
      

      where Siew Weng is the first name of the target, and Seetoh is the last name of the target.

The last command will take some time to run. This is what it will return

6598999978,100009308285955,Siew Weng,Seetoh,male,,,,,,some@example.com,

There, the some@example.com email address is found. (We censored the actual email).

Method C: Find Emails From Twitter Profile History

Using advanced operators in a Google search, you can search a Twitter account history for occurrences for which he/she might have shared his email address publicly.

This method requires a Twitter ID.

1. Search the following on Google: inurl:twitter.com/nubela email; where nubela is the Twitter account you want to search.

I used my profile, and immediately, you can see that an email address (go@getgom.com) was found. Google search has a result for which I revealed publicly on Twitter that I'm contactable at an old email address.

Method D: Find Emails With Bing

People often divulge their contact information on public forums. As with Method C, you can find email addresses with a good search phrase with operators. In this method, we use Bing because their results are more precise compared to Google.

This method requires a domain of a forum and a username.

1. Search the following on Bing (where Weijia is the username and forums.hardwarezone.com.sg is the domain of the forum)`:
   1. site:forums.hardwarezone.com.sg "@gmail.com" "Weijia"
   2. site:forums.hardwarezone.com.sg "@yahoo.com" "Weijia"
   3. site:forums.hardwarezone.com.sg "@hotmail.com" "Weijia"
   4. site:forums.hardwarezone.com.sg "@outlook.com" "Weijia"

Just like that, the email address of said user is found to be zedricktay@gmail.com.

Lookup Work & Professional Emails

As the name suggests, work email addresses are email addresses that a business assigns to employees. Unfortunately, work emails often stop working when an employee leaves because employees come and go. So work email addresses get stale after some time. Nevertheless, work email addresses are easier to extract with specialized methods.

There are two methods to get the work email addresses of people.

The first method is to use Clearbit Connect. Clearbit Connect works by stealing the email contacts of 100000+ users that are using it. It works by crowdsourcing email addresses from users, albeit in an unethical manner.

The second method uses Proxycurl's Work Email Lookup Endpoint, which works by using publicly available data via best practices such as email permutation, web scraping, and email verification.

As much as it does sound like I'm shilling, but Proxycurl's Work Email Lookup API works at least 3x better than Clearbit's solution. In a blog post to research Clearbit's efficacy, we found that Clearbit found 13.2% real and deliverable work email addresses. In comparison, Proxycurl's Email Lookup API found 51.2% real and deliverable work email addresses.

Regardless of ethics, I'd recommend that you pick Proxycurl's Work Email Lookup Endpoint simply because it works better and costs just $0.10 per search. So, for work emails, do follow this table to get to an email address.

Method E: Use Proxycurl Email Lookup API

Proxycurl's Email Lookup works 51% of the time, based on my personal research after trying to find work email addresses of around 3000+ Linkedin Profiles.

This method requires a Linkedin Profile ID.

1. Create a free account on Proxycurl. Once you are signed in, you will need the API key found in the dashboard. Save this somewhere.

2. Install WIndows Subsystem for Linux if you are using Windows. If you use Linux or Mac, you are fine.

3. Open a bash terminal

   1. curl \
          -X GET \
          -H "Authorization: Bearer ${YOUR_API_KEY}" \
          https://nubela.co/proxycurl/api/linkedin/profile/email?linkedin_profile_url=https%3A%2F%2Fsg.linkedin.com%2Fin%2Fsteven-goh-6738131b&cache=no-cache
      

      • Where YOUR_API_KEY is the API key found in the dashboard
      • and steven-goh-6738131b is the Linkedin Profile ID.

   2. Wait 15 minutes as the Proxycurl service takes some time to lookup the email address.

   3. Run the same command again. Now, you will get the following result:

{
  "email": "steven@nubela.co",
  "status": "email_found"
}

There you go, work email is found.

Lookup A Million Work Email Addresses For Sales Automation

Most of the methods I listed are very menial, and they work well if you have one target. What if you have a million of them? The good news is that Proxycurl's Email Lookup is made as an API, so you can programmatically integrate that into your system to automate sales. That's how we did it. And if you need help, feel free to shoot us an email at hello@nubela.co, and I will see what I can do for you!

Want to hear more stories?

And if you love reading anecdotes as to how we are solving business problems with our data tools, click here to subscribe to our email list :)