Email Address Detection Scanner

Web applications serve as the primary digital interface between organizations and their users, publishing contact information, support channels, and operational details to facilitate communication. Email addresses are among the most commonly published pieces of contact data, appearing in footer sections, contact pages, about pages, and embedded mailto links throughout a site. Organizations ranging from small businesses to large enterprises routinely expose one or more email addresses to allow customers, partners, or press to reach them. These addresses may belong to generic roles such as info@ or support@, or to named individuals including executives, sales representatives, and technical staff. Web applications built on content management platforms often aggregate contact details across multiple pages without a centralized review of what is publicly surfaced. The collection of email addresses from web properties is a standard step in reconnaissance activities conducted by both legitimate security assessors and malicious actors.

Email address detection refers to the automated harvesting of contact addresses that are publicly accessible within a web application's HTML content. Addresses may be present in plain text within page bodies, embedded inside anchor tags as mailto: links, or included in structured data and JavaScript blocks. While publishing a contact email is often intentional, the automated aggregation of these addresses at scale poses risks that manual publication does not anticipate. Harvested email lists are routinely used as inputs for phishing campaigns, credential stuffing attacks, and social engineering operations targeting organizational staff. Even role-based addresses such as admin@ or hr@ provide adversaries with useful entry points for spear-phishing attempts tailored to specific functions within an organization. Organizations may be unaware of how many distinct addresses are surfaced across their subpages, particularly when contact details are embedded in page templates or third-party widgets.

The scanner fetches the root page of the target asset via a headless browser, falling back to a plain HTTP request if the browser-based fetch fails. It then parses anchor tags to identify contact-related subpages using a keyword list that includes contact, iletisim, hakkimizda, about, about-us, bize-ulasin, and bize-yazin, visiting up to five matching pages on the same domain. On each collected HTML document, script and style blocks are stripped before the remaining text is scanned with an RFC 5321-aligned email regular expression covering standard local parts and domain suffixes. In parallel, the scanner searches the raw HTML for mailto: links using a dedicated pattern to capture addresses that may not appear in visible page text. A noise-filter pattern suppresses common false positives including placeholder addresses, image filenames parsed as emails, and known test domains such as example.com and wpackagist.org. Deduplicated results are associated with their source pages and reported as email-to-URL pairs in the detailed output.

Harvested email addresses are primary targets for bulk phishing campaigns, where attackers send deceptive messages impersonating trusted services to capture credentials or deliver malware. Role-based addresses such as finance@, hr@, or ceo@ enable highly targeted spear-phishing attacks crafted to match the responsibilities of the recipient, significantly increasing the likelihood of a successful compromise. Email addresses collected from web pages are frequently sold to or shared among spam networks, resulting in persistent unsolicited communications that consume staff time and degrade productivity. Attackers may use discovered addresses as inputs for credential stuffing attacks against corporate email systems, VPN portals, and cloud service login pages. The presence of personal staff email addresses on public pages may constitute a privacy violation under data protection regulations such as GDPR, exposing the organization to regulatory risk. In combination with other OSINT data, a harvested email list enables adversaries to map the organizational structure and identify high-value targets for further compromise.