# Email Address Discovery and Harvesting

> Techniques for discovering and harvesting email addresses from public sources to map organisational attack surfaces and identify exposed personnel.

- **URL:** https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-discovery
- **Path:** OSINT > Identity & People Intelligence > Email Intelligence
- **Up:** [Email Intelligence](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence.md)
- **Published:** 2026-04-11
- **Updated:** 2026-08-11

## Overview

Email discovery finds addresses associated with a person or organisation using passive and semi-passive sources. The goal is a candidate list of real addresses to verify and investigate further. Starting points are typically a full name combined with a domain, a company name, or a known address you want to expand on.

- **Hunter.io** queries a domain for all associated addresses, confirmed sources, and the organisation's email naming pattern.
- **theHarvester** collects addresses from search engines, PGP key servers, and certificate transparency logs across sources Hunter does not cover.
- **Google dorking** targets indexed PDFs, spreadsheets, and web pages that contain email addresses missed by harvesting tools.
- **PGP key servers** expose addresses published by developers and security researchers alongside their signing keys.
- **GitHub commit history** reveals personal or internal email addresses from author fields in public repositories.

## Hunter.io

Hunter finds email addresses published on the web and associated with a domain. It returns confirmed addresses, the sources they were found on, and the organisation's email pattern.

Query a domain for all associated addresses:

```bash
curl -s "https://api.hunter.io/v2/domain-search?domain=$DOMAIN&api_key=$HUNTER_API_KEY" | jq '.data.emails[].value'
# "j.smith@example.com"
# "sarah.jones@example.com"
# "admin@example.com"
```

Find a specific person's address at a domain:

```bash
curl -s "https://api.hunter.io/v2/email-finder?domain=$DOMAIN&first_name=$FIRST&last_name=$LAST&api_key=$HUNTER_API_KEY" | jq '.data.email'
# "j.smith@example.com"
```

Hunter also returns the organisation's email pattern in the domain search response. If it shows `first.last` as the pattern, you can generate addresses for any name at that domain with high confidence.

## theHarvester

theHarvester collects email addresses from multiple public sources including search engines, PGP key servers, and certificate transparency logs. It is useful for broad discovery across sources that Hunter does not cover.

```bash
theHarvester -d $DOMAIN -b all -l 500
# [*] Emails found: 12
# ------------------
# j.smith@example.com
# info@example.com
# support@example.com
```

Use `-b google,bing,linkedin` to limit to specific sources if a full run is too slow or noisy. The LinkedIn source requires a valid LinkedIn session cookie configured in the tool settings.

## Google Dorking for Email Addresses

Search engines index email addresses that appear in publicly accessible documents, forum posts, and web pages. Targeted dorks surface addresses that harvesting tools miss:

```
"@example.com" site:example.com
"@example.com" filetype:pdf
"@example.com" filetype:xlsx OR filetype:csv
"firstname.lastname" "@example.com"
"contact" OR "email" "@example.com"
```

Document filetypes are especially productive. Spreadsheets, PDFs, and Word documents published accidentally often contain internal distribution lists, staff directories, or contact sheets with dozens of addresses.

## PGP Key Servers

Developers and security researchers frequently publish their email addresses on public PGP key servers when uploading signing keys. Search by name or domain:

```bash
curl -s "https://keys.openpgp.org/vks/v1/search?q=$DOMAIN" | grep -oE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'
```

## GitHub Commit History

Git commits include the author's email address by default and this data is publicly visible in commit history on GitHub and other public repositories. Organisations and individuals frequently expose personal or internal email addresses through code commits.

Search GitHub for commits from a domain:

```bash
curl -s "https://api.github.com/search/commits?q=author-email:$DOMAIN&per_page=100" -H "Accept: application/vnd.github.cloak-preview" | jq '.items[].commit.author.email' | sort -u
```

For a specific repository, clone it and extract all commit emails from the log:

```bash
git log --format='%ae' | sort -u
```

## Email Pattern Derivation

Once you have the organisation's email pattern from Hunter or from analysing discovered addresses, you can generate addresses for any target at that organisation. Common patterns:

```
firstname.lastname@domain.com
f.lastname@domain.com
firstname.l@domain.com
flastname@domain.com
firstnamelastname@domain.com
firstname@domain.com
```

Generated addresses need verification before use. Pass them to the [email verification](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-verification) workflow to confirm which ones are live.

## References

- [Hunter.io API Documentation](https://hunter.io/api-documentation/v2) - Domain search and email finder endpoint reference
- [theHarvester: GitHub](https://github.com/laramies/theHarvester) - Multi-source email and subdomain harvesting tool
- [OpenPGP Key Server](https://keys.openpgp.org) - Public PGP key server searchable by name, email, or domain