> [!info] > Input: [[Website Domain|domain]], [[Social Media Account|personal page]] > Output: [[Email Address|email]], [[Phone Number|phone]] > > Types: [[Behavioural Weakness|behavioural]], [[Business Weakness|business]] > Weakness: [[SOWEL-22. Providing Contact Information]] > Functionality: [[SOFL-11. Links and Personal Pages]] ### Explanation People and organisations routinely publish their contact details in plain text wherever they expect to be reached. The "page" here means any page on which the target wants to receive feedback — and this includes **two distinct families** of sources: - **Websites and standalone personal/company pages** — `contacts.html`, `/about`, `/team`, `/impressum`, footers, academic faculty pages, project landing pages. - **Social-media profile pages and bio aggregators** — the bio/about field of an Instagram, X/Twitter, TikTok, LinkedIn, YouTube channel, Telegram or Discord profile, the "Business inquiries: ..." line in a creator's channel description, and link-in-bio aggregators such as Linktree, Carrd, About.me, Beacons. The same logic applies to **business pages, communities and groups** (Facebook Pages and Groups, VK groups, LinkedIn company pages, Telegram channels) — admins routinely list their personal contact for inbound moderation or partnership requests, exposing the people behind the brand. In either case, even when one profile is empty or pseudonymous, the same person's contact page or bio elsewhere often spells out a real-name email or phone number — because the entire point of those surfaces is to be reachable. **Don't stop at the live site — check archived snapshots.** Footers, team pages and contact sections are frequently updated to remove old emails or replace them with role addresses. The Wayback Machine and Archive.today often preserve earlier versions where the personal email or direct phone was still listed — couple this technique with [[SOTL-7.1. Check Archives]] for full coverage. When the technique works best: - Long-lived personal or small-business websites (years of Wayback history). - Academia, consulting, freelance — contexts where being reachable is the point of the page. - Creators, businesses and public figures on social media — they actively want inbound contact and put a "Business inquiries" email or a link-in-bio aggregator front and centre. - Targets who once had a real-name domain or open bio and later cleaned it up: the cleanup rarely covers archived snapshots of either the site or the profile. Limitations: - Modern sites obfuscate emails (`name [at] domain [dot] com`, JS rendering, images) — simple text extraction misses these. - Role addresses (`info@`, `contact@`) dilute the signal and should be treated as low-confidence. - Finding an address on a page confirms only that it appears there, not that it belongs to the target — cross-check with [[SOTL-6.1. Check Logins Reuse to Find Another Account]]. ### Examples - [Using Archive.org for OSINT Investigations](https://www.osintcurio.us/2021/03/03/using-archive-org-for-osint-investigations/) — walk-through that includes recovering removed contact info from archived pages - [OSINT on Deleted Content](https://www.osintcurio.us/2019/02/12/osint-on-deleted-content/) — older but canonical post on pulling deleted content (incl. contacts) from caches and archives ### Tools - [kronikier](https://kronikier.soxoj.com/) — pulls contact information (emails, phones) from every historical snapshot of a website on web.archive.org, automating the archive-scraping pipeline end-to-end - [theHarvester](https://github.com/laramies/theHarvester) — passive recon framework that aggregates emails from search engines, certificate transparency logs, breach DBs and other public sources - [EmailHarvester](https://github.com/maldevel/EmailHarvester) — focused crawler that pulls email addresses from Google/Bing/Yahoo/etc. and a handful of social plugins ### See also - [[SOTL-7.1. Check Archives]] - [[SOTL-22.1. Check Commits of Source Code]] - [[SOTL-22.4. Study Media for Contacts]] - [[SOTL-6.1. Check Logins Reuse to Find Another Account]]