X Twitter Lead Scraper

X / Twitter Lead Scraper 📱

Turn a keyword into a list of public X (Twitter) profiles that publish a contact email.

You type startup founder. The actor finds public X profiles matching that phrase, opens each one, reads the public profile bio, and returns every genuine email address it finds — with the profile name, handle, bio and profile URL attached. No login, no cookies, no X API key.

Works for both twitter.com and x.com — they are the same service under two domains, and both are searched and accepted.

How it actually works ⚙️

This section is deliberately specific, because "how" matters for a platform as locked-down as X.

Step 1 — Discovery. The actor asks search engines which public X profiles match your keyword, using a site-restricted query such as:

(site:twitter.com OR site:x.com) -site:business.twitter.com … "@gmail.com" "startup founder"

Google is the primary source (it indexes X profile bios and paginates deeply), with DuckDuckGo, Brave and Bing rotated in for extra breadth. Google no longer exposes the destination URL of an organic result — every result link is now an opaque, server-encrypted /goto?url=CAES… redirect. Five recovery routes therefore run and are merged, because coverage differs from query to query:

1. direct http(s) anchors and the legacy /url?q= wrapper, when Google still emits them
2. the result title — Umme habiba (@P2Pwriter) / Posts / X. On X the handle is the URL, so the profile address is reconstructed from the title. This is the most productive route for this host.
3. the <cite> breadcrumb — https://x.com › DrArchanadines1 › status, plain text that survives the wrapper
4. the inline JSON data island's ["<url>","<title>","<snippet>"] triples
5. a raw-text sweep of the page for on-host URLs

Every candidate is then verified by actually loading the profile, so a wrong guess from a loose route cannot reach your dataset. DuckDuckGo, Brave and Bing serve real destination links, which are used directly.

Step 2 — Profile read. Each discovered handle is opened at https://x.com/<handle> through a residential proxy. Logged out, X still serves real Open Graph metadata on that page:

• og:title → the display name and handle — Naman Sondhi (@VCwithNS) on X
• og:description → the profile bio verbatim — which is exactly where X users publish contact addresses

A handle that does not exist returns HTTP 404, so this doubles as an existence check. This is a real fetch of the live profile page, not a cached copy.

Step 3 — Email extraction, in order of confidence:

1. x_profile_bio — the address is in the live profile bio. Highest confidence.
2. search_snippet — the address appears in the profile's own indexed page content (posts/replies) as surfaced by the search engine. Genuine and on that account's page, though not always the account owner's personal mailbox.
3. linked_website — the bio had no address but linked out to a website via a t.co link; the actor resolved that link and found a contact address on the destination site. Optional, on by default.

Every row records which of the three it came from, in the emailSource field.

What this actor does not do 🙅

Honest limits, so you know what you are buying:

• ❌ It does not log in to X, and does not use the paid X API.
• ❌ It does not read follower counts, profile images, geo/location fields, tweet timelines, DMs, or anything else behind X's login wall. Logged out, X exposes the display name, handle and bio on a profile page — that is what is used.
• ❌ It does not return rows with an empty email. If a profile publishes no contact address, it is skipped rather than padded out.
• ❌ It does not invent, sample or mock data. If a keyword yields nothing, the log says so plainly.

Output 📤

Every field in every row is populated with a real value. Example rows from a live run:

[
  {
    "network": "x.com",
    "keyword": "startup founder",
    "handle": "@utpalghosh30",
    "title": "Utpal Ghosh (@utpalghosh30)",
    "description": "|| Dreamer & Entrepreneur || Building Protein Box || For Consulting/Mentorship/Franchise : email : utpalghoshofficial@gmail.com",
    "url": "https://x.com/utpalghosh30",
    "email": "utpalghoshofficial@gmail.com",
    "emailSource": "x_profile_bio"
  },
  {
    "network": "x.com",
    "keyword": "startup founder",
    "handle": "@VCwithNS",
    "title": "Naman Sondhi (@VCwithNS)",
    "description": "Venture Capital Documenting anything and everything VC Former founding operator Email: vcwithns@gmail.com https://t.co/4qcyX8KwsG",
    "url": "https://x.com/VCwithNS",
    "email": "vcwithns@gmail.com",
    "emailSource": "x_profile_bio"
  }
]

Output table

Field	Description
network	The X domain the lead was matched on — x.com or twitter.com
keyword	The keyword from your input that produced this lead
handle	The public @handle of the account
title	Display name plus handle, read from the live profile
description	The public profile bio (falls back to the indexed page snippet when the bio is empty)
url	Direct link to the public profile
email	The extracted contact address — never empty
emailSource	x_profile_bio · search_snippet · linked_website

Input 🧩

{
  "keywords": ["startup founder"],
  "platform": "Twitter",
  "location": "",
  "emailDomains": ["@gmail.com"],
  "maxEmails": 20,
  "engine": "legacy",
  "proxyConfiguration": { "useApifyProxy": true, "apifyProxyGroups": ["RESIDENTIAL"] }
}

Field	Description
keywords	Required. One or more phrases to search profiles for. Niche phrases beat broad ones.
platform	Social network. Twitter — covers both twitter.com and x.com.
location	Optional. Adds a city/region phrase to the search to geo-narrow the leads.
emailDomains	Keep only leads on these domains (e.g. @gmail.com). Also sharpens the search query. Empty = all domains.
maxEmails	Leads to collect per keyword before moving on. Default 20.
engine	Extraction pipeline label. legacy.
searchEngines	Advanced. Which discovery sources to use and in what order. Default: google, duckduckgo, brave, bing.
enrichFromLinkedSite	Advanced. Follow the website linked in a bio when the bio itself has no email. Default true.
maxProfilesPerKeyword	Advanced. Cap on how many profiles are opened per keyword. Default 120.
proxyConfiguration	Advanced. Network used to load x.com pages. Default RESIDENTIAL, which is verified to work.

A note on proxies

The actor uses three network roles and they are not interchangeable:

• Google search always goes through Apify's GOOGLE_SERP group. That group can only reach Google, so it is never used for anything else — if you set it as your proxyConfiguration, the actor detects that and falls back to RESIDENTIAL for page fetching rather than silently failing.
• DuckDuckGo / Brave / Bing go through a datacenter group; those engines rate-limit residential exits hard.
• x.com profile pages and linked websites use your proxyConfiguration (RESIDENTIAL by default).

Tips for more leads 💡

• Use specific keywords (fractional cmo, ugc creator, dropshipping mentor) rather than generic ones.
• Keep @gmail.com in emailDomains for precision, or clear the filter to accept business domains too.
• Raise maxProfilesPerKeyword for rare niches — most X users never publish an email, so the actor has to read many profiles to find the ones that do.
• Pass several related keywords in one run; each is budgeted separately.

Use cases 🎯

• Building targeted outreach lists from public creator/founder/agency profiles
• Sourcing partners and collaborators in a niche
• Market and academic research on public social profiles

Legal & ethical use ⚖️

This actor reads only publicly available data from public profile pages — the same information any logged-out visitor sees. It does not bypass the login wall, does not touch private accounts, and does not use authenticated APIs.

• ⚖️ Comply with X's terms of service and with applicable data protection law (GDPR, CAN-SPAM, etc.)
• ⚖️ Have a lawful basis before using extracted addresses for commercial outreach
• ⚖️ Do not spam. Honour opt-outs.
• ⚖️ Do not use the output for harassment, profiling of sensitive traits, or any unlawful purpose

FAQ ❓

Does it need an X/Twitter account, cookies or API key? No. Everything comes from logged-out public pages and public search engine results.

Why do some rows have emailSource: "search_snippet"? Because the address was on that profile's indexed page content rather than in the bio field itself. It is a real address found on that account's page — just treat it with slightly less confidence than a bio address.

Why did my keyword return few or zero leads? Most X users do not publish an email anywhere public. The actor reports exactly how many profiles it opened and how many published a matching address. Widen emailDomains, raise maxProfilesPerKeyword, or try a keyword that professionals put in their bio.

Can it scrape private or protected accounts? No.

Does twitter.com still work? Yes. Both domains are searched, and results on either are accepted. Profile URLs are emitted on the domain they were matched on.

Support and feedback

• Bug reports: open a ticket in the repository Issues section
• Custom features / enterprise support: dev.scraperengine@gmail.com