9 Tools & Tactics to Track Down Website Contact Information (2023)

If you are only looking at the WhoIs record, you won't see much. However, using this tool, you can go back and view old records and see the original info they used when they registered the domain. I've found contact information for more than one site owner this way.

2. BuzzStream

BuzzStream is an incredibly useful tool for prospecting and outreach. Their bookmarklet is particularly helpful in adding sites to a list that you may want to reach out to later, and the window that launches when you click the bookmarklet includes a contact section that is populated with any contact information they can find for the site - email addresses, contact pages, and social media accounts.

Here is what it found when I used the bookmarklet on Search Engine Round Table:

3. SpyOnWeb.com / NetComber.com

SpyOnWeb.com (free) and NetComber.com (freemium) are two of my favorites... I just feel so clever when I'm using them. They both look for footprints across websites to tie them together. So, for instance, they'll look for sites that share the same IPs or Nameservers, or sites that use the exact same Analytics code.

If you find other sites that are owned by the same person, then you can use tactics likes historical WhoIs records on the other domains to try to turn up contact information. It widens your pool and really provides you with more opportunities. Here is what SpyOnWeb.com finds when running it on Search Engine Land:

4. NerdyData.com

NerdyData.com is like the Google of website source code. You can search for any IDs or footprints and NerdyData.com will crawl the web's source code to find it and serve up the results to you.

This tool gives me that same giddy feeling that I get when I use SpyOnWeb.com. The obvious uses are to search for Analytics IDs and Adwords IDs, but the options are really endless.

One way to really get the most out of it is to comb through the source code of your target site for any unique identifiers, such as Omniture or Salesforce IDs. Then, armed with those unique identifiers, NerdyData.com can scour the web for other sites using those same IDs. Or, you can take it to the next level using NerdyData.com in combination with BuiltWith.com (#5). The end result is that you can find other websites owned by the same person, thus giving you more leads and opportunities to identify an owner.

Here are the results that came up when I searched NerdyData.com using the Analytics ID I found on TechCrunch.com:

5. BuiltWith.com

I love me some BuiltWith.com. The elevator pitch is that BuiltWith.com identifies all of the technologies that a website is using; all of their analytics packages, CMS tools, mail providers, hosting and CDN technologies, and much more.

Here is how we would use this to track down contact information. Let's say I want to track down more information on Mashable. I begin by putting Mashable into BuiltWith.com and find these Analytics tools that they have on their page:

I see that they have NewRelic tracking installed, so now I'll jump to their source code and look for that along with an associated ID:

Then, from there, I transition back over to NerdyData.com and search on that ID. The results are pretty interesting. For example:

1. If I didn't know that Pete Cashmore owned Mashable, now I do, as that code is also on PeteCashmore.com
2. Pete, or someone at Mashable, may be working on a weightloss site, as the New Relic code is used on weightloss-getstarted.com
3. The site TwitterBlooper.com was registered right after Pete wrote a post using that phrase and explained how forgetting the 'D' at the front of a DM is just one of many ways to put something on Twitter inadvertently

As you can see from the screenshot below, this is just a sampling of the information you can uncover with this tactic. These tools can really boost your ability to locate a hunkered down site owner.

6. Mining Twitter

This next one is so simple and yet so effective. I've toyed with mining contact information from Google in the past (as you'll see in #7), and it is often effective but not always pretty. However, this tactic from Ross Hudgens is both effective and elegant. It uses the 'site:' command to search a Twitter user's tweets for their email address.

It goes without saying that you'll first need the site owner's Twitter account, which is something you can often find on a site even where there is little else to go on for contact info. Once you have it, you simply search their tweets like this:

Clicking on the first search result leads you right to his email address - doesn't get much easier than that. A similar approach to this, but using AllmyTweets.net, is presented by Emma Still in this post. These are all very effective at finding a reliable email address.

7. Google Searches

I did warn you that this was the least pretty of them all, right? Ok, good. Searching Google for email addresses is all about brute force and persistence. You just need to search as many combinations of the name, domain name, and other keywords in hopes of finding the proverbial needle in a haystack. Here are some of the combinations that you might add to your repertoire:

• "@example.com" (to find if it was put anywhere out on the web)
• at example dot com (helps to identify those that wrote their address in a way that spammers couldn't scrape it)
• Example.com privacy policy email (searches any privacy policy pages for the mention of an email address)
• Examples.com terms of use email (searches a Terms page for any email address mentions)
• Jim Smootherz email (if the person has a unique name, such as in this example, try searching it along with 'email')
• Jim Smootherz example dot com
• jim Smootherz @example.com

8. Rapportive Hack

Rapportive is an amazing tool that provides rich information about people you are communicating with right in your inbox. If you don't have it installed yet, stop reading and grab it right now.

Rob Ousbey did such a great job building out a framework to use for email discovery, that you should really read his post for the full tactic. In short, what you do is create a number of possible email addresses using a spreadsheet, and then test each of those in your Rapportive-enhanced inbox. Once you've entered in a working email address, Rapportive populates with social media data, indicating that you've got a live one.

If you are dealing with a company, a great tool to help you identify what email address domain they use is email-format.com. For example, I worked at Sallie Mae years ago, and at that time we used @slma.com for our email addresses even though our site was salliemae.com. If you used @salliemae.com, the email wouldn't have worked. Email-Format.com would let you know that even though the domain is salliemae.com, the email address format was slma.com.

Here is a walkthrough of the strategy from Rob:

9. MailTester.com

Let's say Rapportive doesn't turn anything up for you, perhaps because they haven't registered any social profiles with their email address. Well, you don't have to stop there. You can try all of those email combinations from the step above in MailTester.com, which can help you determine if the email address is valid or not by running a check against the domain's mail server. It doesn't work every time as some servers have this feature disabled, but as you can see from the screenshot below, when it works, it works!

To be successful at finding contact information, you need a little bit of luck and a lot of hustle and know-how. It seems that there are more unique circumstances than there are surefire tactics, so the more you can use tools, and combine their power, the better. I hope you've found something in this list that will help you in your next contact searching quest.

Let us know your favorite tools or tactics for finding contact information in the comments below!