Information Gatheringosintemailphonenumberscrapingbruteforcepasswordreset

email2phonenumber

OSINT tool that obtains a target's phone number using only their email address by exploiting password reset mechanisms and public data sources.

Description

email2phonenumber is an OSINT tool designed to discover phone numbers associated with email addresses. It automates the process by abusing weaknesses in password reset functionality across various websites and leveraging publicly available phone numbering plan data.

The tool supports three primary functions: scraping websites for phone number digits via password reset initiation, generating lists of valid phone numbers based on country-specific numbering plans, and bruteforcing phone numbers against online services to correlate masked emails with the target.

Use cases include OSINT investigations, reconnaissance, and target profiling where email addresses are known but phone numbers need to be discovered through automated enumeration techniques.

How It Works

The tool operates through three main modes. 'Scrape' initiates password reset requests using the target email on multiple websites, extracting partial phone number digits from the reset pages. 'Generate' creates comprehensive lists of valid phone numbers using public Phone Numbering Plan data like NANPA records. 'Bruteforce' iterates through generated phone number lists, triggers password resets on various services, and matches returned masked emails to identify the correct number associated with the target email.

Installation

bash
sudo apt install email2phonenumber

Flags

-h, --helpshow this help message and exit

Examples

Display the help menu and usage information for the tool
email2phonenumber -h
Initiate scraping mode to extract phone number digits from online services using password reset functionality
email2phonenumber scrape
Generate all valid phone numbers based on NANPA's public records for a specific country
email2phonenumber generate
Bruteforce using online services to find the target phone number by correlating masked emails
email2phonenumber bruteforce
Scrape websites for phone digits associated with the specified email address
email2phonenumber scrape target@example.com
Generate valid US phone numbers using public numbering plan data
email2phonenumber generate --country US
Bruteforce a phone number list against services to match the target email
email2phonenumber bruteforce phonelist.txt target@example.com
Updated 2026-04-16kali.org ↗