There are many legitimate reasons to you may want to email someone whose business email address is not known like:
- Reconnecting with a lost friend or business associate.
- Contacting a person to sell them a product or service that your company offers.
- Resolving a customer service issue.
To be clear, I am NOT advocating stealing or guessing someone's email password for the sole purpose of spying, spamming, stalking, demanding ransom, or taking over a business email account for purposes never intended by the owner.
Now, you could guess and send multiple emails to addresses you think represent the genuine email address, but who has that kind of time?
This post demonstrates the ease with which you can take the name of someone that works for an organization and decode their email address in 7 easy steps and in less than 5 minutes.
1. Google Their Full Name & Email Address
This might sound like an elementary step that you have already thought of, but if you haven't done this one, kindly perform it first.
You may already know their middle name, but you might need to Google it to find out, if possible, since this will help you find the precise person for whom you are searching. This especially applies if the person has a common first name, last name, or both.
The simplest way is to query a search engine (like Google) is with a phrase like "John Smith email address" or "John Smith Amazon email address" if John works at Amazon. But if this simple search fails, how do we decode a business email address?
2. Try Finding a LinkedIn First Connection at Same Organization
If you find an email on LinkedIn, then you can take the username email structure and insert the name of the person you want to reach.
I selected Anthony Miller, one of my first connections @ Amazon, since he has the same first name as I do middle name. But this would work on any profile that is a first connection, since you can see their email address, assuming they have their work email listed and not a personal email addy. I obscured his email address below, so people don't spam him, but you get the idea.
If that doesn't work, proceed to the next step.
3. Perform WHOIS Search on Organization's Domain Name
I typically use Whois.net, but there are many other options. Just Google "whois" and enter the domain name you are seeking. You will find an email address(es) or a redirected one for privacy. The latter will not help you at all.
If the email address is not the domain name of the organization or is private, go to the WHOIS page of that domain registrar and complete another WHOIS search there.
If that fails, then move on to the next step.
4. Search Company Website for Username Email Structure
Sometimes, you will get lucky and can find the specific person's email address on the company website. If not, then check these common places emails are listed to understand the typical username email structure:
- Press page
- Investor page
- Individual press releases
- Contact Us
- About Us
Some username email structures are straightforward...
And some have versions of the above with dots or underscores in between the first and last name/initial.
5. Verify the Validity of the Email Address
Go to tools.verifyemailaddress.io and enter the email address you believe is valid.
If your Google or company website search doesn't clearly define the standard username structure of emails inside that particular organization, enter the different permutations you believe may be possibilities to validate which one is the correct one.
6. Send Your Targeted Email, Wait For a Response, & Feel Like a White Hat Hacker