<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-email-address-harvesting
description: >-
  Harvest email addresses associated with a target domain using search engines,
  OSINT tools, breach databases, and API services for reconnaissance and
  social engineering preparation.
domain: cybersecurity
subdomain: osint-recon
tags:
  - email-harvesting
  - theHarvester
  - hunter-io
  - email-enum
  - phishing-prep
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  theHarvester, hunter.io API, phonebook.cz, snov.io,
  h8mail, CrossLinked.
metadata:
  mitre-attack:
    - "T1589.002"  # Gather Victim Identity Information: Email Addresses
    - "T1598"      # Phishing for Information
    - "T1593"      # Search Open Websites/Domains
---

# Performing Email Address Harvesting

## Overview

Email harvesting collects email addresses associated with a target domain using
search engines, OSINT databases, breach data, and specialized APIs. Harvested
emails support social engineering assessments, credential stuffing tests,
employee enumeration, and organizational mapping. Combining multiple sources
with pattern analysis maximizes coverage.

## Prerequisites

- theHarvester for multi-source email gathering
- Python 3.10+ with `requests`
- API keys: Hunter.io, Snov.io, Clearbit (optional)
- h8mail for breach data correlation
- CrossLinked for LinkedIn email generation

```bash
pip install theHarvester requests h8mail
pip install crosslinked
```

## Quick Reference

| Task | Command |
|------|---------|
| theHarvester all | `theHarvester -d example.com -b all -f output` |
| theHarvester google | `theHarvester -d example.com -b google -l 500` |
| Hunter.io search | `curl "https://api.hunter.io/v2/domain-search?domain=example.com&api_key=$KEY"` |
| Email verify | `curl "https://api.hunter.io/v2/email-verifier?email=user@example.com&api_key=$KEY"` |
| h8mail breach | `h8mail -t user@example.com` |
| CrossLinked | `crosslinked -f '{first}.{last}@example.com' 'Company Name'` |

## Workflow

### Step 1: Multi-Source Harvesting

```bash
# theHarvester — aggregates emails from multiple search engines
theHarvester -d example.com -b all -l 500 -f harvester_output

# Specific sources
theHarvester -d example.com -b google,bing,linkedin,dnsdumpster -l 200

# With Shodan
theHarvester -d example.com -b shodan -l 100
```

### Step 2: Hunter.io API Harvesting

```bash
# Domain email search
curl -s "https://api.hunter.io/v2/domain-search?domain=example.com&api_key=$HUNTER_KEY" \
  | jq '.data.emails[] | {email: .value, type: .type, confidence: .confidence}'

# Email pattern detection
curl -s "https://api.hunter.io/v2/domain-search?domain=example.com&api_key=$HUNTER_KEY" \
  | jq '.data.pattern'
# Returns patterns like: "{first}.{last}" or "{f}{last}"

# Email verification
curl -s "https://api.hunter.io/v2/email-verifier?email=john.doe@example.com&api_key=$HUNTER_KEY"
```

### Step 3: LinkedIn-Based Email Generation

```bash
# CrossLinked — scrape LinkedIn names and generate email patterns
crosslinked -f '{first}.{last}@example.com' 'Target Company' -o emails.txt
crosslinked -f '{f}{last}@example.com' 'Target Company' -o emails_alt.txt
```

### Step 4: Breach Data Correlation

```bash
# h8mail — check harvested emails against breach databases
h8mail -t emails.txt --breach-compilation /path/to/breachcomp

# Single email check
h8mail -t user@example.com
```

### Step 5: Email Validation and Deduplication

```python
import re

def extract_emails(text: str) -> list[str]:
    """Extract and deduplicate emails from text."""
    pattern = r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'
    return sorted(set(re.findall(pattern, text.lower())))

def infer_pattern(emails: list[str], domain: str) -> str:
    """Infer email naming pattern from collected addresses."""
    patterns = {"first.last": 0, "flast": 0, "firstl": 0, "first": 0}
    for email in emails:
        local = email.split("@")[0]
        if "." in local:
            patterns["first.last"] += 1
        elif len(local) > 6:
            patterns["flast"] += 1
    return max(patterns, key=patterns.get)
```

## Detection Opportunities

- Search engine scraping triggers rate limits and CAPTCHAs
- Hunter.io queries logged against the querying API key
- LinkedIn scraping detected by anti-bot measures
- Email verification attempts may appear in mail server logs

## Verification

- [ ] theHarvester queried across multiple search engines
- [ ] Hunter.io API returns emails with confidence scores
- [ ] Email naming pattern identified for the organization
- [ ] Harvested emails validated for deliverability
- [ ] Breach data checked for compromised credentials
- [ ] Results deduplicated and categorized by source

## References

- [theHarvester](https://github.com/laramies/theHarvester)
- [Hunter.io API](https://hunter.io/api-documentation)
- [h8mail](https://github.com/khast3x/h8mail)
- [CrossLinked](https://github.com/m8sec/CrossLinked)
- [Phonebook.cz](https://phonebook.cz/)

---
v1.0 | Validated: 2026-03-17
