2 ways to find the full email of a place on Google Maps
A few days ago, Pangar Ban (https://twitter.com/BanPangar) published a method for finding the part of email for a place on Google Maps.
- Copy place URL to https://pleper.com/index.php?do=tools&sdo=cid_converter.
2. Click convert and generate.
3. Copy CID decimal and add to link https://business.google.com/create?fp=
As you can see, this method only shows a small portion of the email. And at first glance, this data doesn’t seem very useful for investigation. But there are many ways to find information on a portion of an email (as well as phone number, domain, etc.). In this article, I will tell you about two of them in detail.
1. OverPass Turbo contacts search
Open https://overpass-turbo.eu/, find target location on map and run query:
[bbox:{{bbox}}];
(
node[“email”~”i*@*chaaf.nl”];
);
out meta;
>;
out qt;
Replace ”i*@*chaaf.nl” to target email.
Yeah, sure, you can just find the same place on OpenStreetMap. But this query will show all locations associated with a particular email. For example, it will show the whole chain of cafes of one owner.
If you are able to find the full email, I also recommend running another query:
1. Zoom out the search area slightly.
2. Search for all emails associated with a specific domain: [“email”~”*@companydomain.com”]
You can also search for related items by using other tags to find contact information in OverPass Turbo:
[“phone”]
[“website”]
[“contact:mobile”]
The biggest disadvantage of this method is that OpenStreetMap does not contain much data. Only 663 thousand objects on the map contain email address information.
So, but don’t stop at one method and keep searching.
2. IP search engines search
IP search engines allow you to search the text of http responses from all sites and servers connected to the internet. And unlike traditional systems such as Google, they support searches using wildcards and regular expressions.
Here is an example of a Netlas query to find an email, some of whose characters are unknown in http titles (emails and phones are often listed in the description block):
http.title:19*ates http.title:gmail.com
Pay attention to 3 important rules:
1. Do not use the @ symbol. It is not indexed.
2. Instead, divide the query into two parts.
3. If you need to replace many characters, use — *, if you need to replace one character, use ?.
Similarly, you can search for emails in the metadata of web pages using the http.meta advanced search filter.
Search filters http.meta and http.title can be used in Netlas for free (50 times per day). But there are special filters for searching contact data available after purchasing a subscription. For example:
certificate.issuer.email_address:
ftp.contacts.email:
whois.net.contacts.emails:
And dozens other search filters for search emails, phones and postal codes (see pic above).
I will not write about other IP search engines (Shodan, Censys, Fofa etc) in this article, but they seem to have similar features for searching full email addresses on their part.
Other ways
Any service that supports searching using regular expressions or wildcards will do for searching a full email by its part. Every day more and more services for searching documents, companies, open databases, etc. are starting to support them. You can find some of them on my Twitter.
I think that someday I will collect a big list of such services (if you know them, write in comments).
