- [[Passive Reconnaissance]] There are several websites that can be used to find email addresses of targets - [hunter.io](https://hunter.io) - [phonebook.cz](https://phonebook.cz/#) - [Clearbit Connect](https://clearbit.com/resources/tools/connect) In addition to simple searches, emails of a domain can be used to identify whether there is a pattern in email generation. Such as {f}{last}@domain.com eg: [email protected] Once a candidate email is found, another tool such as [emailhippo](https://tools.emailhippo.com) or [Email-Checker](https://email-checker.net) can be used to verify the validity of it. If the email has a recovery function such as google, the secondary email can be used to link across email addresses.