Peepmail: Discover people's private business email addresses

The most obvious way that this is working is as follows:

- Checks the MX record for the domain name listed. - Attempts to connect to the SMTP port of the listed MX record - Attempts to create RCPT TO lines using permutations of the name in common formats (firstname.lastname@, lastname@ firstletterlastname@, etc). Reports the first one back that is a match - which may be a major false positive as well:

    Connected to smtp.ins.dell.com (143.166.83.183).
    Escape character is '^]'.
    220 pc-smtp.us.dell.com ESMTP
    HELO
    250 pc-smtp.us.dell.com
    MAIL FROM: test@tester.com
    250 sender <test@tester.com> ok
    RCPT TO: mdell@dell.com
    250 recipient <mdell@dell.com> ok
    RCPT TO: michael.dell@dell.com
    250 recipient <michael.dell@dell.com> ok
    RCPT TO: dell.michael@dell.com
    550 #5.1.0 Address rejected dell.michael@dell.com
    RCPT TO: michaeldell@dell.com
    250 recipient <michaeldell@dell.com> ok
    QUIT
    221 pc-smtp.us.dell.com
    Connection closed by foreign host.

I don't expect the majority of those to really go to the person listed as they are probably fielded by other employees first for legitimacy (just a guess).

This is a good idea and would be a really useful service, but doing it this way doesn't work. What the app is doing is using SMTP to try various permutations of the name to see if the email is rejected or accepted by the email server. The problem is that almost every email server is configured to return false data for spam protection. If you want to see the process in more detail, you can look at http://centralops.net/co/ which will make the queries directly.

One could use the google API to make a better version of this with more intelligence. Often you can use google to find email addresses of a company's employees with some educated guessing, or you can at least figure out the format (eg firstname.lastname@example.com). As it stands this current version only works with perhaps 1 in 5 or 10 domains.

Looks fake. I made up a name and it happily gave me an email address. Recent searches look fabricated too.

Honeypot for business contacts/HN users?

You're upvoting a tool that is harvesting information for spearfishing and advertising? Really? Engage your critical thinking capability.....

I don't get it. Is it just a database of the format used for particular domains (e.g. First.Last@example.com) ?

This is interesting. How does this work?

Click the privacy policy link at the bottom. Get "Really? What privacy?"

Great idea.

But the product does not work.