How to find the email address of a user on LinkedIn?

The business and employment-oriented social network platform LinkedIn is very popular among Dutch people. According to Newcom Research & Consultancy the Netherlands counted approximately 4.6 million active LinkedIn users in 2018. Compared to the year 2017 the amount of users increased with approximately 6 percent (+250.000 users). Are you planning to investigate Dutch people from in between 18 and 65 years old? Then there is a big chance your target is active on LinkedIn.

LinkedIn investigations

LinkedIn investigations do not seem to be very interesting. Except for a profile picture and the profile information, the LinkedIn profile of a random user does not provide that much information, does it? The opposite is true, because LinkedIn profiles do contain some very interesing information. The email address of an user for example. So, how do we find an email address? We will explain below.

From LinkedIn profile to an email address

When visiting a profile on LinkedIn, it often is possible to find out the email address that is connected to the account. The easiest way to find the email address is to click on “Contact details“. A lot of LinkedIn users haven’t configured their privacy settings properly, making information such email addresses, dates of birth, social media profiles and websites publicly available. Please make sure to always check the contact details of your target.

Haven’t found an email address yet?

When clicking the contact details doesn’t provide us with any results, we have to explore other options to find out the email address of an user. Please take the following steps.

Step 1: visit LinkedIn.com and login with your credentials. The functionality below does not work without a LinkedIn account. Please pay attention to the following: to ensure your privacy and safety always use a fake account.

Step 2: open the following link in a new tab:
https://www.linkedin.com/sales/gmail/profile/viewByEmail/e-mailadres.

Step 3: replace “e-mailadres” with the email address of your target. Hit the enter button and you will be presented with the results automatically.

Wait a minute!?

We don’t even know the email address of our target? The point of this blogpost was to figure out the related email address, wasn’t it? Yes, and it still is. So hold on! The following step is the fun part, this is because you will have to guess the email address of your target account. Yep, you have to guess it. But this is way more easy than you probably think.

Business and private email addresses

What email address do you use on LinkedIn? You probably use either a business email address or a private email address. And both are easy to track down. PLease give it a try with your own account of with account of someone you (don’t) know.

How to find a business email address?

We will start with the easy-to-guess business email addresses. In our example we are looking for the email address of a Senior Lead Recruiter at ING. The first thing to do is to find out what corporate email address of ING look like. We start this of by looking at the domain names (e.g. @ing.nl) used by ING.

A simple bit of Googeling works very well (especially with these 15 operators!). In our case this leads to the website ofING where is stated which email addresses are used by ING: “ING mailt je alleen met emailadressen die eindigen op @ing.nl, @ing.com, @mail.ing.nl, @emailing.ing.nl, @verzekeren.ing.nl, @businessboost.nl, @emailing.businessboost.nl of @ingprivatebanking.nl.“

We now only have to find out what the format is that is used. Often the format is easy to guess, because a lot of organizations tend to use combinations of initials, first names and surnames (john.doe@, j.doe@, doe.j, et cetera). Try every combinations untill you succeed and you will find out which business email address is used by your target.

How to find a private email address?

In our case the employee of ING does not use his business email for his LinkedIn account. Therefore, we will have a closer look a his private email address. Again this is a guessing excercise, but this time you will need to use your brains. What are common email providers in Netherlands?

Thinking of common email providers in The Netherlands, international providers as Hotmail.com, Gmail.com, Outlook.com and providers like Ziggo, KPN en Telfortmight come up your mind. Another option is that the domain of a self registered or hosted website like info@aware-online.com is used. Again you will have to play with the combinations of initials, first names and last names.

Aren’t there any tools available?

Sure there are! There are a lot of Open Source Intelligence (OSINT) tools available, for example you can use a tool that creates combinations of email formats. The Email Permutator of Metric Sparrow provides you with possible email addresses based on the name and provider information that you provide. Please check out the results below. Are you looking for other tools? Please reach out for more information.

Think about your privacy and security

The use of third party tools may result in privacy and security risks. Please be aware of privacy and security risks at all times. Aware Online Academy is not responsible for thirds party tools, has no interest in these tools and is not liable for its use.

Find the email address of a LinkedIn user