osintverse-community/theharvester
Gathers emails, subdomains, hosts and IPs for a domain from public search engines and datasets
Takes domain → finds email, ip, subdomain
No key · Docker
No key · Docker
Verified publisher
Find the email addresses at a domain
5 tools. 2 run with ot in a sandbox on Windows, macOS and Linux; 4 with otlite on Linux and macOS, no Docker. Compare them side by side ↓
The addresses people at an organisation use are scattered across search results, key servers, code repositories and data brokers. These tools collect them for a domain and, with Hunter, return the organisation's address pattern (first.last@, f.last@…), which lets you work out an address you haven't seen from a name you have.
With ot, in a sandbox
All domain tools →Windows, macOS and Linux, with Docker or Podman. Each tool runs in a read-only container that can reach only the sites it declares, and every result comes back in the same JSON shape.
osintverse-community/hunter-domain-search
Lists the email addresses Hunter has found for a domain, with names, positions, confidence and the address pattern
Takes domain → finds email, organization, person
Key required · Docker
Key required · Docker
Verified publisher
ot install osintverse-community/theharvester osintverse-community/hunter-domain-searchInstalls the first 2 in one go; ot auto d:… then runs every installed tool that takes a domain and saves the results. No ot yet? Install it in one line.
Without Docker, with otlite
All otlite tools →Linux and macOS. otlite installs each one with pip or git into its own virtualenv, pinned to a version it has tested: otlite install theharvester.
- theHarvesterFind emails, subdomains and names for a domainTakes domain
- MailaccessInvestigates an email address across 5,300+ platforms and breach sources, and harvests the email addresses of…Takes email, domain · dual-use
- CrosslinkedLinkedIn enumeration tool to extract valid employee names from an organization through search engine scrapingTakes username, email, name
- SpiderfootSpiderFoot automates OSINT for threat intelligence and mapping your attack surfaceTakes domain, IP address, username, email
The 2 registry tools side by side
| osintverse-community/ | email, organization, person | Required | Online, passive | Yes | Docker | No reports yet | fewer than 10 |
| osintverse-community/ | email, ip, subdomain | None | Online, passive | Yes | Docker | No reports yet | fewer than 10 |
Facts from each tool's manifest and what people report about whether it works. "Reaches" says whether a run stays offline, reads public sources, sends requests about the target, or may notify them.
How to find the email addresses at a domain
- Harvest the addresses public sources already show for the domain (theharvester).
- Work out the address pattern from them, or read it from Hunter (hunter-domain-search).
- Check addresses you build from staff names with a registration check on the email page before relying on them.
Every registry tool here runs on your machine in a sandbox, and ot auto d:… runs all the installed ones on one value.
Before you run one
Can I check that an address exists without emailing it?
Partly. Registration checks (holehe, on the email page) show whether services have an account on it, and many mail servers refuse to say whether a mailbox exists. Sending a message to test it notifies the person, and none of these tools does that.
Why does Hunter need a key?
Hunter is a commercial service with a free monthly allowance, and the key identifies your account. theharvester's default sources need no key; some optional ones add results with keys of their own.
Do these tools send my search anywhere?
No. ot runs each tool on your own machine in a read-only container that can only reach the sites the tool declares, and results stay in your results folder. The registry only counts installs.
More from a domain
SubdomainsEvery known URLLook-alike domainsWHOIS recordDNS recordsAll domain tools