How to scrape and verify email addresses

🔍 Level Up Your Email Investigations with Email OSINT Tools! 📧✨ Ever struggled to track down email addresses or verify their authenticity during your investigations? This Email OSINT Cheat Sheet is a treasure trove of powerful tools and tricks to streamline your email-based recon and investigations. Here’s a snapshot of some standout tools: 🚩 The Harvester • Scrape emails and usernames from multiple sources (Google, LinkedIn, Twitter). 🔎 SimplyEmail • Effortlessly gather emails linked to domains with rapid enumeration. 🎯 Holehe • Quickly verify if an email is registered across platforms like Twitter or Instagram. 📌 Quidam & Mailcat • Investigate usernames and identify connected email addresses. 🛠️ MOSINT • Automated email OSINT framework to uncover social media profiles and breaches. ✨ Bonus Tools: Zen, Yopmail & more! Email OSINT is critical for: • Threat hunting and cybersecurity investigations. • Digital forensics and incident response. • OSINT enthusiasts and analysts. 👉 Pro tip: Combine multiple tools for comprehensive recon and cross-verification. Which email OSINT tool do you prefer in your toolkit? Drop your recommendations below! #OSINT #EmailOSINT #CyberSecurity #DigitalForensics #ThreatIntelligence #InfoSec #Recon #SecurityTools #Investigation #BlueTeam #ThreatHunting

How we’re using Prospeo and BounceBan to 1.5X the size of our lead lists scraped from Apollo.io: For a vast majority of our lead lists, we use Apollo for decision maker data since it’s become quite cheap and effective with Apollo scrapers. Thing is, when scraping leads from Apollo, scrapers really only find about 60% of decision makers emails from the Apollo list’s, resulting in a ton of potential data lost. This is where Prospeo comes in. With all contacts that haven’t had emails found, we can use Prospeo’s enrichment API inside Clay to find any missing addresses that are available in their database. We can then verify these emails with MillionVerifier + verify Catch-All emails with BounceBan (Verify risky emails without sending messages). Here’s what this workflow looks like in Clay: 1. HTTP API (MillionVerifier) to verify emails provided in CSV. 2. HTTP API (BounceBan) to verify all catch_alls (conditional formula: ONLY run on columns that include catch_alls). 3. Prospeo: Run on rows that don’t have emails. 4. HTTP API (BounceBan) to verify all Prospeo catch_alls (conditional formula: ONLY run on columns that include catch_alls). 5. Merge columns with all emails that are valid (CSV + Prospeo). This workflow allows for a good chunk more valid data that would typically be missed by only using Apollo and Millionverifier, 100% recommend running your lists through this flow.

Did you know that even a terrible cold email can book meetings? A new client joined AB Mastermind the other day who broke all the rules: The subject line was weak Scripts were basic And there wasn’t even a case study in the email… And yet… he was BOOKING MEETINGS before he even joined I thought the gurus said the email templates mattered? That you needed the perfect subject line… I thought you needed the best call to action (oof) But NONE of that matters if you mess up this: His 4/10 emails WORKED… because he spent a lot of time on lead verification (more time than he spent on scripting that’s for sure lol) Here’s what he did: * He found a job board of his target audience - NOT a list pulled from a database * He verified these people on LinkedIn to make sure they actually exist * Once he had their LinkedIns, he used an Expandi.io search to find their main emails - not their corporate ones So every email he sent hit an ACTIVE real person’s main inbox Most people assume cold email is all about the perfect subject line or irresistible offer. But none of that matters if your list is trash. Here’s how to fix it: 1. Scrape Fresh, Active Data You can pull thousands of leads from Apollo, ZoomInfo, or any database - but a lot of your leads will be: * People who no longer work at the company * Emails that aren’t actively monitored * Unverified emails that WILL bounce If you want real responses, you need leads who are active and engaged. One of the best ways to find them? Scrape commenters on industry-specific posts. But you have to pick the right posts.. "Best cold email templates" ? Good. Memes? No. Commenters are far more likely to respond… Not just because they are looking… But because they are ACTIVE 2. Verify Every Lead Before You Email A verified lead isn’t just an email that doesn’t bounce. It’s someone who: * Still works at the company * Uses that email actively * Actually checks their inbox Here’s how to confirm that before sending: Manually check - are they still at the company? Run it through NeverBounce by ZoomInfo, Findymail, or LeadMagic (or all of them) Just because an email came from a “trusted” database doesn’t mean it’s valid (50/50 chance at best) You can check manually, but at scale, automate it with AI agents (which you can also use Clay for) But even with verified leads, your deliverability setup determines whether your emails ever get seen: 3. Send The Right Way Cold email isn’t 2023 anymore. If you’re still sending from a free Gmail account, Google Workspace, Microsoft 365, or using a basic mail merge, you’re setting yourself up for failure: * A free Gmail or outlook won’t tank deliverability, but it looks spammy and unprofessional for B2B * Google Workspace and M365? They are trying their best to destroy cold email The only way to do it right in 2025? A custom SMTP setup. Join AB Mastermind and we can fix this together.

VP Sales: "We need 10,000 decision-maker emails for our ABM campaign." Me: "Show me what you're using now." "Apollo, ZoomInfo, some Linked In screping." No wonder their bounce rate was 27%. We audited an Adobe partner's email database. 8,000 "verified" contacts from premium data vendors. Ran them through our validation stack: • Syntax check (RFC 5322 compliance) • DNS/MX record verification   • SMTP handshake without sending • 100% Catch-all verification • Role-based email filtering (info@, sales@) • Honeypot/spam trap cross-reference • Disposable domain detection • Corporate email pattern matching Real deliverable emails? 3,712. But we went deeper with our 43 B2B APIs: • Email age scoring (how long at company) • Job change detection (LI API + news monitoring) • Email engagement history (opens/clicks from 3rd party data) • Domain reputation scoring • IT infrastructure mapping (O365 vs Google Workspace) • Email alias detection (same person, multiple addresses) All this through EmailAddress .ai, in a few minutes. The ACTUAL list? 2,847 emails. These 2,847 were: - Primary business emails (not aliases) - Active in last 90 days - Still at the company - Direct dial enriched (67% match rate) - Mobile numbers added (31% coverage) - Personal email backup (for job changes) Campaign results after 60 days: • Original 8,000: 27% bounce, 0.3% reply rate, domain blacklisted • Validated 2,847: 0.9% bounce, 4.7% reply rate, sender reputation intact One client saved $32K for this campaign by NOT burning through domains and IPs. Plus gaining a lot more responses compared to previous campaigns. In B2B, your sender reputation is your lifeline. You can't rebuild it with a credit card. What's your email validation process beyond "the vendor said it's verified"?

How to Turn Incomplete Lists into Pipeline: Based on sending 5M+ emails over the last 2 years across dozens of outbound funnels. 1️⃣ Use a Contact Enrichment Waterfall: → Start with a broad contact list from a database like Apollo.. even if it’s incomplete. → Enrich missing emails with tools like Icypeas, Prospeo.io, and LeadMagic → Verify every email using LeadMagic and Enrichley to weed out bounce risks. Result: 20–30% more valid contacts in your total addressable market (TAM). 2️⃣ Scrape Websites for Qualifying Signals: → Use web scrapers like ZenRows or Firecrawl to pull text from company websites. → Run GPT to scan for keywords or tech stacks that match your ICP profile. → No coding needed, use pre-built scrapers straight from the marketplace. 3️⃣ Automate Deep Web Research with Claygent → Use Claygent to find anything from pricing pages to social links to case studies. → Extract niche data like director changes or SIC codes from public filings. → Claygent automates research that would take hours. at scale and for pennies on the dollar. P.S. Want the exact templates we use for these workflows? DM me and I'll send em over.